Lucene search

HpeCVE-2022-23668

HistoryMay 16, 2022 - 9:15 p.m.

CVE-2022-23668

2022-05-1621:15:07

CWE-918

hpe

web.nvd.nist.gov

cve

2022

23668

ssrf

vulnerability

aruba

clearpass

policy manager

nvd

security

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

48.0%

JSON

A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manage that address this security vulnerability.

Affected configurations

Nvd

Node

arubanetworksclearpass_policy_managerRange<6.8.9

arubanetworksclearpass_policy_managerRange6.9.0–6.9.10

arubanetworksclearpass_policy_managerRange6.10.0–6.10.5

arubanetworksclearpass_policy_managerMatch6.8.9-

arubanetworksclearpass_policy_managerMatch6.8.9hotfix1

arubanetworksclearpass_policy_managerMatch6.8.9hotfix2

VendorProductVersionCPE
arubanetworksclearpass_policy_manager*cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.8.9cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:-:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.8.9cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix1:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.8.9cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix2:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	clearpass_policy_manager	*	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::
arubanetworks	clearpass_policy_manager	6.8.9	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:-::::::
arubanetworks	clearpass_policy_manager	6.8.9	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix1::::::
arubanetworks	clearpass_policy_manager	6.8.9	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.8.9:hotfix2::::::

CNA Affected

[
  {
    "product": "Aruba ClearPass Policy Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

48.0%

JSON

Related for CVE-2022-23668