CVE-2022-44535

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated users to escalate their privileges to those of an administrative user. A successful exploit could allow an attacker to achieve administrative privilege on the web-management interface leading to complete system compromise in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jan 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-44549.8A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the CVE-2022-445429.8lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution via CVE-2022-445435.3The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted group CVE-2022-445449.8Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger CVE-2022-445467.5The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation CVE-2022-445477.5The Display Service module has a UAF vulnerability. Successful exploitation of this vulnerability may affect the display service availabilit CVE-2022-445484.3There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may CVE-2022-445497.5The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to acc CVE-2022-44556.1A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulat CVE-2022-445507.5The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affect CVE-2022-445519.8The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integri CVE-2022-445527.5The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availab