CVE-2020-7115

🗓️ 03 Jun 2020 12:43:13Reported by hpeType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 145 Views🌐 WEB

ClearPass Policy Manager web interface vulnerability allows authentication bypass and remote command execution. (CVE-2020-7115

Reporter	Title	Published	Views	Family All 19
0day.today	ClearPass Policy Manager Unauthenticated Remote Command Execution Exploit	8 Jul 202000:00	–	zdt
0day.today	Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution Exploit	10 Jul 202000:00	–	zdt
ATTACKERKB	CVE-2020-7115	3 Jun 202000:00	–	attackerkb
Tenable Nessus	Aruba Networks ClearPass Policy Manager 6.7.x < 6.7.13-HF / 6.8.x < 6.8.5-HF / 6.9.x < 6.9.1 Multiple Vulnerabilities (ARUBA-PSA-2020-005)	17 Jul 202000:00	–	nessus
Circl	CVE-2020-7115	9 Oct 202013:36	–	circl
CNVD	Aruba Networks ClearPass Policy Manager Access Control Error Vulnerability	4 Jun 202000:00	–	cnvd
Check Point Advisories	Aruba Networks ClearPass Policy Manager Remote Code Execution (CVE-2020-7115)	23 May 202100:00	–	checkpoint_advisories
Cvelist	CVE-2020-7115	3 Jun 202012:43	–	cvelist
Exploit DB	Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution	10 Jul 202000:00	–	exploitdb
HPE Security Bulletins	HPESBNW04013 rev.2 - HPE Aruba ClearPass Policy Manager, Remote Code Execution	22 Jul 202000:00	–	hpe

NVD

Node

arubanetworks clearpass_policy_managerRange6.7.0–6.7.13

arubanetworks clearpass_policy_managerRange6.8.0–6.8.6

arubanetworks clearpass_policy_managerRange6.9.0–6.9.1

[
  {
    "product": "ClearPass Policy Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "ClearPass 6.9.x prior to 6.9.1 ClearPass 6.8.x prior to 6.8.5-HF ClearPass 6.7.x prior to 6.7.13-HF"
      }
    ]
  }
]

Source	Link
arubanetworks	www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt
packetstormsecurity	www.packetstormsecurity.com/files/158368/ClearPass-Policy-Manager-Unauthenticated-Remote-Command-Execution.html

Parameter	Position	Path	Description	CWE
clientPassphrase	request body	tips/tipsSimulationUpload.action	Unauthenticated remote command execution via webUI upload endpoint (CVE-2020-7115) leading to RCE after authentication bypass.	CWE-306
uploadClientCertFile	request body	tips/tipsSimulationUpload.action	Unauthenticated remote command execution via webUI upload endpoint (CVE-2020-7115) leading to RCE after authentication bypass.	CWE-306

17 Jun 2026 03:24Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

CVSS 210

EPSS0.64596