Arista Edge Threat Management
CVEs (10)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-27889 | Hig | 0.58 | 8.8 | 0.09 | Mar 4, 2024 | Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying… | ||
| CVE-2024-9188 | Hig | 0.57 | 8.8 | 0.00 | Jan 10, 2025 | Specially constructed queries cause cross platform scripting leaking administrator tokens | ||
| CVE-2024-9134 | Hig | 0.54 | 8.3 | 0.01 | Jan 10, 2025 | Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges. | ||
| CVE-2024-47519 | Hig | 0.54 | 8.3 | 0.00 | Jan 10, 2025 | Backup uploads to ETM subject to man-in-the-middle interception | ||
| CVE-2024-9132 | Hig | 0.53 | 8.1 | 0.01 | Jan 10, 2025 | The administrator is able to configure an insecure captive portal script | ||
| CVE-2024-47520 | Hig | 0.49 | 7.6 | 0.00 | Jan 10, 2025 | A user with advanced report application access rights can perform actions for which they are not authorized | ||
| CVE-2024-9131 | Hig | 0.47 | 7.2 | 0.01 | Jan 10, 2025 | A user with administrator privileges can perform command injection | ||
| CVE-2024-47517 | Med | 0.44 | 6.8 | 0.00 | Jan 10, 2025 | Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access | ||
| CVE-2024-9133 | Med | 0.43 | 6.6 | 0.00 | Jan 10, 2025 | A user with administrator privileges is able to retrieve authentication tokens | ||
| CVE-2024-47518 | Med | 0.42 | 6.4 | 0.00 | Jan 10, 2025 | Specially constructed queries targeting ETM could discover active remote access sessions |
- risk 0.58cvss 8.8epss 0.09
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying…
- risk 0.57cvss 8.8epss 0.00
Specially constructed queries cause cross platform scripting leaking administrator tokens
- risk 0.54cvss 8.3epss 0.01
Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
- risk 0.54cvss 8.3epss 0.00
Backup uploads to ETM subject to man-in-the-middle interception
- risk 0.53cvss 8.1epss 0.01
The administrator is able to configure an insecure captive portal script
- risk 0.49cvss 7.6epss 0.00
A user with advanced report application access rights can perform actions for which they are not authorized
- risk 0.47cvss 7.2epss 0.01
A user with administrator privileges can perform command injection
- risk 0.44cvss 6.8epss 0.00
Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access
- risk 0.43cvss 6.6epss 0.00
A user with administrator privileges is able to retrieve authentication tokens
- risk 0.42cvss 6.4epss 0.00
Specially constructed queries targeting ETM could discover active remote access sessions