CVE-2023-43509

2023-10-2518:17:32

CWE-79

[email protected]

web.nvd.nist.gov

clearpass policy manager

web interface

unauthenticated

remote attacker

notifications

computers

phishing

malicious software

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

EPSS

0.001

Percentile

30.1%

JSON

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.

Affected configurations

Nvd

Node

arubanetworksclearpass_policy_managerRange<6.9.13

arubanetworksclearpass_policy_managerRange6.10.0–6.10.8

arubanetworksclearpass_policy_managerRange6.11.0–6.11.4

arubanetworksclearpass_policy_managerMatch6.9.13-

arubanetworksclearpass_policy_managerMatch6.9.13cumulative_hotfix_patch_2

arubanetworksclearpass_policy_managerMatch6.9.13cumulative_hotfix_patch_3

arubanetworksclearpass_policy_managerMatch6.10.8-

arubanetworksclearpass_policy_managerMatch6.10.8cumulative_hotfix_patch_2

arubanetworksclearpass_policy_managerMatch6.10.8cumulative_hotfix_patch_5

VendorProductVersionCPE
arubanetworksclearpass_policy_manager*cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.9.13cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.9.13cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.9.13cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.10.8cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.10.8cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2:*:*:*:*:*:*
arubanetworksclearpass_policy_manager6.10.8cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	clearpass_policy_manager	*	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::
arubanetworks	clearpass_policy_manager	6.9.13	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-::::::
arubanetworks	clearpass_policy_manager	6.9.13	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2::::::
arubanetworks	clearpass_policy_manager	6.9.13	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3::::::
arubanetworks	clearpass_policy_manager	6.10.8	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-::::::
arubanetworks	clearpass_policy_manager	6.10.8	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2::::::
arubanetworks	clearpass_policy_manager	6.10.8	cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5::::::