Hewlett Packard Enterprise Aruba ClearPass
At a glance
- Source
- NVD
- EPSS
- EPSS 3.89 % · percentile 90 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Modified
Description
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest captive portal, and API. Customers who do not expose ClearPass web interfaces to untrusted users are impacted to a lesser extent.
Weaknesses (CWE)
- CWE-287 — Improper Authentication
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-18801
- GCVE · GCVE-0-2018-7058
CERT-FR advisories
- CERTFR-2018-AVI-144 — Multiples vulnérabilités dans Aruba ClearPass · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:hp:aruba_clearpass_policy_manager:*:*:*:*:*:*:*:*≥ 6.6.0 < 6.6.9
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise · Aruba ClearPass | affected 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |