Specially constructed queries cause cross platform scripting leaking administrator tokens

Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

A user with administrator privileges is able to retrieve authentication tokens

The administrator is able to configure an insecure captive portal script

A user with administrator privileges can perform command injection

A user with advanced report application access rights can perform actions for which they are not authorized

Backup uploads to ETM subject to man-in-the-middle interception

Specially constructed queries targeting ETM could discover active remote access sessions

Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access

Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.