CVE-2023-37440

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	EdgeConnect SD-WAN Orchestrator	>= Orchestrator 9.3.x, <= <=9.3.0; >= Orchestrator 9.2.x, <= <=9.2.; >= Orchestrator 9.1.x, <= <=9.1.

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txtMitigation, Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txtMitigation, Vendor Advisory

Timeline

Published: Aug 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374427.8Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .v CVE-2023-374437.8Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .v CVE-2023-374447.8Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .v CVE-2023-374457.8Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .v CVE-2023-374467.8Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .v CVE-2023-374477.8Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .v CVE-2023-374483.3A lock screen issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. A user may be able to view restric CVE-2023-37455.5A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local at CVE-2023-374508.8The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5,CVE-2023-374534.6An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in d CVE-2023-374545.5An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf CVE-2023-374555.4The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability