Reflected Cross Site Scripting in EdgeConnect SD-WAN Orchestrator Web Management Interface

published 2023-08-22 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-41339

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.

Patch / fix

fixed in 1

arubanetworks edgeconnect_sd-wan_orchestrator 9.1.8, 9.2.6

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-02)

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator

Classification

Weakness

CWE-922 Insecure Storage of Sensitive Information
CWE-79 Improper Neutralization of Input During Web Page Generation

References

arubanetworks.com /assets/alert/ARUBA-PSA-2023-012.txt
mitigation, vendor-advisory

Sources

CVE List CVE-2023-37439
NVD CVE-2023-37439

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary