Lucene search

HpeCVE-2022-23685

HistorySep 20, 2022 - 9:15 p.m.

CVE-2022-23685

2022-09-2021:15:10

CWE-352

hpe

web.nvd.nist.gov

cve-2022-23685

csrf

aruba

clearpass policy manager

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

39.8%

JSON

A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against these endpoints if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.

Affected configurations

Nvd

Node

arubanetworksclearpass_policy_managerRange6.9.0–6.9.12

arubanetworksclearpass_policy_managerRange6.10.0–6.10.7

VendorProductVersionCPE
arubanetworksclearpass_policy_manager*cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	clearpass_policy_manager	*	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::

CNA Affected

[
  {
    "product": "Aruba ClearPass Policy Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.10.x: 6.10.6 and below"
      },
      {
        "status": "affected",
        "version": "6.9.x:  6.9.11 and below"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Social References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

39.8%

JSON

Related for CVE-2022-23685