High WID-SEC-2022-2251 12 CVEs

Aruba ClearPass Policy Manager: Mehrere Schwachstellen

Published Dec 6, 2022 · Updated Dec 6, 2022 · de-DE

Vendor: Aruba Product: ClearPass Policy Manager Product: ClearPass Policy Manager < 6.10.8 Product: ClearPass Policy Manager < 6.11.0 Product: ClearPass Policy Manager < 6.9.13 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Aruba ClearPass Policy Manager ausnutzen, um SQL Injection- und Cross Site Scripting Angriffe durchzuführen, Code zur Ausführung zu bringen, seine Rechte zu erweitern oder Informationen offenzulegen.

Product

Aruba ClearPass ist eine Netzwerk-Zugangskontrolllösung.

Vulnerabilities 12

High 8.8

CVE-2022-43530

Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 8.8

CVE-2022-43531

Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 8.0

CVE-2022-43532

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 7.8

CVE-2022-43533

A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their u…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 7.8

CVE-2022-43534

A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their u…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 7.8

CVE-2022-43535

A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate the…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 7.2

CVE-2022-43536

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 7.2

CVE-2022-43537

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
High 7.2

CVE-2022-43538

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
Medium 5.7

CVE-2022-43539

A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privilege…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
Medium 5.5

CVE-2022-43540

A vulnerability exists in the ClearPass OnGuard macOS agent that allows for an attacker with local macOS instance acces…

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Jan 3, 2023
Unscored —

CVE-2002-20001 Public exploit EPSS 25%

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that…

Nov 11, 2021

Revision history

2022-12-06 #1
Initiale Fassung

References

Aruba Product Security Advisory vom 2022-12-06
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt