CVE-2018-7079

Aruba ClearPass Policy Manager: CVE-2018-7079 describes a guest-authorization failure in ClearPass Guest where certain administrative operations do not enforce privileges, enabling any authenticated administrative user to view, modify, or delete guest users regardless of privilege level. The issu...

CVE-2018-7067

Aruba ClearPass Policy Manager vulnerability CVE-2018-7067 is an authentication bypass in the administrative API that can lead to complete cluster compromise. A remote attacker who can reach the admin web interface via the API can bypass authentication and take control of the entire ClearPass clu...

CVE-2018-7065

Aruba ClearPass Policy Manager is affected by an authenticated SQL injection vulnerability (CVE-2018-7065) that could allow an authenticated admin to obtain the 'appadmin' credentials and lead to complete cluster compromise. Affected versions include 6.7.x prior to 6.7.6 and 6.6.10-hotfix; remedi...

CVE-2018-7079

Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privileg...

CVE-2018-7066

CVE-2018-7066 describes an unauthenticated remote command execution in Aruba ClearPass Policy Manager via the OnConnect feature. A defect in the API used to link other network devices (configuration under CLI Settings for linked devices) could allow a remote attacker to execute arbitrary commands...

CVE-2018-7063

Aruba ClearPass Policy Manager

CVE-2018-7066

An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the...

CVE-2018-7065

An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass are affected by multiple authenticated SQL injection vulnerabilities. In each case, an authenticated administrative user of any type could exploit this...

CVE-2018-7067

A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web...

CVE-2018-7063

In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete...

Partner Perspectives: Put Access Control in Context with ClearPass and Carbon Black

Paul Kaspian is a Senior Product & Solutions Marketing Manager for Aruba, a Hewlett Packard Enterprise company. Strengthen your security defenses by considering endpoint context in access control decisions. As enterprise security continues to evolve, organizations are constantly deploying new...

Aruba ClearPass Cross-Site Scripting Vulnerability

Aruba ClearPass is an access management system from Aruba Networks that integrates network control, application and device management capabilities. The system manages everything related to BYOD Bring Your Own Device from a single location. A cross-site scripting vulnerability exists in Aruba...

Aruba ClearPass Cross-Site Request Forgery Vulnerability

Aruba ClearPass is an access management system from Aruba Networks that integrates network control, application and device management capabilities. The system manages everything related to BYOD Bring Your Own Device from a single location. A cross-site request forgery vulnerability exists in Arub...

CVE-2017-9001

Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...

CVE-2017-9002

All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...

CVE-2018-7059

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...

CVE-2018-7060

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

CVE-2018-7060

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

CVE-2018-7059

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...

CVE-2018-7058

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...