Lucene search

HpeCVE-2022-23658

HistoryMay 16, 2022 - 8:15 p.m.

CVE-2022-23658

2022-05-1620:15:15

hpe

web.nvd.nist.gov

aruba

clearpass

policy manager

remote authentication bypass

vulnerability

cve-2022-23658

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON

A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

Affected configurations

Nvd

Node

arubanetworksclearpass_policy_managerRange<6.8.9

arubanetworksclearpass_policy_managerRange6.9.0–6.9.10

arubanetworksclearpass_policy_managerRange6.10.0–6.10.5

arubanetworksclearpass_policy_managerMatch6.8.9-

arubanetworksclearpass_policy_managerMatch6.8.9hotfix1

arubanetworksclearpass_policy_managerMatch6.8.9hotfix2

VendorProductVersionCPE
arubanetworksclearpass_policy_manager*cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.8.9cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:-:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.8.9cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix1:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.8.9cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix2:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	clearpass_policy_manager	*	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::
arubanetworks	clearpass_policy_manager	6.8.9	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:-::::::
arubanetworks	clearpass_policy_manager	6.8.9	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix1::::::
arubanetworks	clearpass_policy_manager	6.8.9	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix2::::::

CNA Affected

[
  {
    "product": "Aruba ClearPass Policy Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON

Related for CVE-2022-23658