CVE-2022-43529 Security feature bypass in Aruba EdgeConnect Enterprise Orchestration Software

Medium 4.6 Published 3 Jan 2023 Updated 10 Apr 2025

An authenticated attacker can maintain session access after a password reset or session clearing event in Aruba EdgeConnect Enterprise Orchestrator.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-43529?

CVE-2022-43529 is a medium-severity vulnerability in Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterprise Orchestration Software, published on 3 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist a session after a password reset or similar session clearing event. Successful exploitation of this vulnerability could allow an authenticated attacker to remain on the system with the permissions of their current session after the session should be invalidated in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.

Weakness: CWE-384

Which versions are affected by CVE-2022-43529?

It affects 1 product.

Products include Arubanetworks Aruba Edgeconnect Enterprise Orchestrator.

How do I fix CVE-2022-43529?

No fix has been published for CVE-2022-43529 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-43529 being exploited?

There is no known exploitation of CVE-2022-43529 in the wild and no public exploit code.

Sources

Also known as GHSA-x2v6-hm65-m6vw.