Hewlett Packard Enterprise Aruba ClearPass
En bref
- Source
- NVD
- EPSS
- EPSS 0.46 % · centile 40 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Modified
Rechercher sur…
Description
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.
Faiblesses (CWE)
- CWE-352 — Falsification de requête inter-site (CSRF)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-18803
- GCVE · GCVE-0-2018-7060
Avis du CERT-FR
- CERTFR-2018-AVI-144 — Multiples vulnérabilités dans Aruba ClearPass · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*≥ 6.6.0 < 6.6.9cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*≥ 6.7.0 < 6.7.1
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise · Aruba ClearPass | affected 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |