Lucene search

MitreCVE-2013-2269

HistoryOct 01, 2013 - 5:55 p.m.

CVE-2013-2269

2013-10-0117:55:03

CWE-264

mitre

web.nvd.nist.gov

cve-2013-2269

aruba networks

clearpass

amigopod

guest access

access restriction bypass

parameter manipulation

default holding page

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

66.4%

JSON

The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using “parameter manipulation” in conjunction with information from a “default holding page” to discover the link that is used for sponsor approval of the guest request, then performing a direct request to that link.

Affected configurations

Nvd

Node

arubanetworksclearpassMatch5.0.1

arubanetworksclearpassMatch5.1

arubanetworksclearpassMatch5.2

arubanetworksclearpassMatch6.0.1

arubanetworksclearpassMatch6.0.2

Node

arubanetworksclearpass_guestMatch3.0

arubanetworksclearpass_guestMatch3.1

arubanetworksclearpass_guestMatch3.2

arubanetworksclearpass_guestMatch3.3

arubanetworksclearpass_guestMatch3.5

arubanetworksclearpass_guestMatch3.7

arubanetworksclearpass_guestMatch3.9

VendorProductVersionCPE
arubanetworksclearpass5.0.1cpe:2.3:a:arubanetworks:clearpass:5.0.1:*:*:*:*:*:*:*
arubanetworksclearpass5.1cpe:2.3:a:arubanetworks:clearpass:5.1:*:*:*:*:*:*:*
arubanetworksclearpass5.2cpe:2.3:a:arubanetworks:clearpass:5.2:*:*:*:*:*:*:*
arubanetworksclearpass6.0.1cpe:2.3:a:arubanetworks:clearpass:6.0.1:*:*:*:*:*:*:*
arubanetworksclearpass6.0.2cpe:2.3:a:arubanetworks:clearpass:6.0.2:*:*:*:*:*:*:*
arubanetworksclearpass_guest3.0cpe:2.3:a:arubanetworks:clearpass_guest:3.0:*:*:*:*:*:*:*
arubanetworksclearpass_guest3.1cpe:2.3:a:arubanetworks:clearpass_guest:3.1:*:*:*:*:*:*:*
arubanetworksclearpass_guest3.2cpe:2.3:a:arubanetworks:clearpass_guest:3.2:*:*:*:*:*:*:*
arubanetworksclearpass_guest3.3cpe:2.3:a:arubanetworks:clearpass_guest:3.3:*:*:*:*:*:*:*
arubanetworksclearpass_guest3.5cpe:2.3:a:arubanetworks:clearpass_guest:3.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	clearpass	5.0.1	cpe:2.3:a:arubanetworks:clearpass:5.0.1:::::::*
arubanetworks	clearpass	5.1	cpe:2.3:a:arubanetworks:clearpass:5.1:::::::*
arubanetworks	clearpass	5.2	cpe:2.3:a:arubanetworks:clearpass:5.2:::::::*
arubanetworks	clearpass	6.0.1	cpe:2.3:a:arubanetworks:clearpass:6.0.1:::::::*
arubanetworks	clearpass	6.0.2	cpe:2.3:a:arubanetworks:clearpass:6.0.2:::::::*
arubanetworks	clearpass_guest	3.0	cpe:2.3:a:arubanetworks:clearpass_guest:3.0:::::::*
arubanetworks	clearpass_guest	3.1	cpe:2.3:a:arubanetworks:clearpass_guest:3.1:::::::*
arubanetworks	clearpass_guest	3.2	cpe:2.3:a:arubanetworks:clearpass_guest:3.2:::::::*
arubanetworks	clearpass_guest	3.3	cpe:2.3:a:arubanetworks:clearpass_guest:3.3:::::::*
arubanetworks	clearpass_guest	3.5	cpe:2.3:a:arubanetworks:clearpass_guest:3.5:::::::*

Rows per page:

1-10 of 121

References

secunia.com/advisories/53358

www.arubanetworks.com/support/alerts/aid-050813.asc

www.securityfocus.com/bid/59805

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

66.4%

JSON

Related for CVE-2013-2269