Lucene search

HpeCVE-2024-26301

HistoryFeb 27, 2024 - 11:15 p.m.

CVE-2024-26301

2024-02-2723:15:07

hpe

web.nvd.nist.gov

clearpass policy manager

vulnerability

web-based management interface

remote attacker

sensitive information

access control

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Aruba ClearPass Policy Manager",
    "vendor": "Hewlett Packard Enterprise (HPE)",
    "versions": [
      {
        "status": "affected",
        "version": "ClearPass Policy Manager 6.12.x: 6.12.0"
      },
      {
        "status": "affected",
        "version": "ClearPass Policy Manager 6.11.x: 6.11.6 and below"
      },
      {
        "status": "affected",
        "version": "ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below"
      },
      {
        "status": "affected",
        "version": "ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-26301