Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Aruba ClearPass Policy Manager ausnutzen, um beliebigen Programmcode auszuführen oder einen Cross-Site-Scripting-Angriff durchzuführen.
Product
Aruba ClearPass ist eine Netzwerk-Zugangskontrolllösung.
Vulnerabilities 4
-
High 7.2
Authenticated Remote Code Execution (RCE) via OGNL Injection in HPE Aruba Networking ClearPass Web-Based Management Interface
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Successful exploitation could enable the attacker to run arbitrary …
-
Medium 6.4
Authenticated Deserialization Vulnerability in ClearPass Policy Manager Web-Based Management Interface Leading to a Remote Command Execution (RCE)
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands…
-
Medium 4.8
Authenticated Stored Cross-Site Scripting (XSS) in HPE Aruba Networking ClearPass Policy Manager Web-based Management Interface
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perf…
-
Medium 4.7
Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged u…
Revision history
-
#1
Initiale Fassung
References
-
HPE Security Bulletin vom 2024-12-03
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US
-
HPE Aruba Networking Product Security Advisory vom 2024-12-03
https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04761.txt