CVE-2022-23685

2022-09-2020:12:50

hpe

www.cve.org

clearpass policy manager

web-based interface

csrf protection

remote unauthenticated attacker

aruba

security vulnerability

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

39.8%

JSON

A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against these endpoints if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.

CNA Affected

[
  {
    "product": "Aruba ClearPass Policy Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.10.x: 6.10.6 and below"
      },
      {
        "status": "affected",
        "version": "6.9.x:  6.9.11 and below"
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt