title: Unauthenticated Stored Cross-Site Scripting Vulnerability (XSS) in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface
description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
affected:
{
defaultStatus: affected
product: EdgeConnect SD-WAN Orchestrator
vendor: Hewlett Packard Enterprise (HPE)
versions:
lessThanOrEqual: <=9.3.0, status: affected, version: Orchestrator 9.3.x, versionType: semver
lessThanOrEqual: <=9.2.5, status: affected, version: Orchestrator 9.2.x, versionType: semver
lessThanOrEqual: <=9.1.7, status: affected, version: Orchestrator 9.1.x, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL