Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364195);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id(
    "CVE-2026-76750",
    "CVE-2026-76751",
    "CVE-2026-76752",
    "CVE-2026-76753",
    "CVE-2026-76754",
    "CVE-2026-79794",
    "CVE-2026-79796",
    "CVE-2026-79797",
    "CVE-2026-79798",
    "CVE-2026-79799",
    "CVE-2026-79801",
    "CVE-2026-79802",
    "CVE-2026-79803",
    "CVE-2026-79805",
    "CVE-2026-79806",
    "CVE-2026-79807",
    "CVE-2026-79808",
    "CVE-2026-79809",
    "CVE-2026-79810",
    "CVE-2026-79811",
    "CVE-2026-79812",
    "CVE-2026-79813",
    "CVE-2026-79814",
    "CVE-2026-79815",
    "CVE-2026-79816",
    "CVE-2026-79817",
    "CVE-2026-79818"
  );

  script_name(english:"Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)");

  script_set_attribute(attribute:"synopsis", value:
"The remote application is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Aruba ClearPass Policy Manager installed on the remote host is 6.11.x prior to 6.11.16, or 6.14.x prior
to 6.14.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBNW05158 advisory.

  - Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass
    Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary
    code on the affected system. (CVE-2026-76750)

  - Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking
    ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to
    circumvent existing authentication controls and gain administrative access to the affected system.
    (CVE-2026-76752)

  - A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote
    attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful
    exploitation could allow an attacker to run arbitrary database commands. (CVE-2026-76754)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?035b943f");
  # https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05158.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?54e485b1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Aruba ClearPass Policy Manager version 6.11.16 / 6.14.1 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-79805");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-79798");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:arubanetworks:clearpass");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("aruba_clearpass_polman_detect.nbin");
  script_require_keys("Host/Aruba_Clearpass_Policy_Manager/version");

  exit(0);
}

include('vcf.inc');

var app = 'Aruba ClearPass Policy Manager';
var app_info = vcf::get_app_info(app:app, kb_ver:'Host/Aruba_Clearpass_Policy_Manager/version');

var constraints = [
  { 'min_version' : '6.11.0', 'fixed_version' : '6.11.16' },
  { 'min_version' : '6.14.0', 'fixed_version' : '6.14.1' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  flags:{"xss":TRUE, "sqli":TRUE}
);