SQL命令中使用的特殊元素转义处理不恰当（SQL注入）

CVE编号

CVE-2022-43522

利用情况

暂无

补丁情况

N/A

披露时间

2023-01-05

漏洞描述

Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	arubanetworks	aruba_edgeconnect_enterprise_orchestrator	*		Up to (including) 8.10.23.40015
	运行在以下环境
	应用	arubanetworks	aruba_edgeconnect_enterprise_orchestrator	*	From (including) 9.0.0	Up to (including) 9.0.7.40110
	运行在以下环境
	应用	arubanetworks	aruba_edgeconnect_enterprise_orchestrator	*	From (including) 9.1.0	Up to (including) 9.1.4.40436
	运行在以下环境
	应用	arubanetworks	aruba_edgeconnect_enterprise_orchestrator	*	From (including) 9.2.0	Up to (including) 9.2.1.40179

CVSS3评分 8.8

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 低
• 影响范围 未更改
• 用户交互 无
• 可用性 高
• 保密性 高
• 完整性 高

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-ID	漏洞类型
CWE-89	SQL命令中使用的特殊元素转义处理不恰当（SQL注入）

Exp相关链接

- avd.aliyun.com