CVE-2018-7065

Aruba ClearPass Policy Manager is affected by an authenticated SQL injection vulnerability (CVE-2018-7065) that could allow an authenticated admin to obtain the 'appadmin' credentials and lead to complete cluster compromise. Affected versions include 6.7.x prior to 6.7.6 and 6.6.10-hotfix; remedi...

CVE-2018-7079

Aruba ClearPass Policy Manager: CVE-2018-7079 describes a guest-authorization failure in ClearPass Guest where certain administrative operations do not enforce privileges, enabling any authenticated administrative user to view, modify, or delete guest users regardless of privilege level. The issu...

CVE-2018-7063

Aruba ClearPass Policy Manager

CVE-2018-7066

CVE-2018-7066 describes an unauthenticated remote command execution in Aruba ClearPass Policy Manager via the OnConnect feature. A defect in the API used to link other network devices (configuration under CLI Settings for linked devices) could allow a remote attacker to execute arbitrary commands...

Partner Perspectives: Put Access Control in Context with ClearPass and Carbon Black

Paul Kaspian is a Senior Product & Solutions Marketing Manager for Aruba, a Hewlett Packard Enterprise company. Strengthen your security defenses by considering endpoint context in access control decisions. As enterprise security continues to evolve, organizations are constantly deploying new...

Aruba ClearPass Cross-Site Scripting Vulnerability

Aruba ClearPass is an access management system from Aruba Networks that integrates network control, application and device management capabilities. The system manages everything related to BYOD Bring Your Own Device from a single location. A cross-site scripting vulnerability exists in Aruba...

Aruba ClearPass Cross-Site Request Forgery Vulnerability

Aruba ClearPass is an access management system from Aruba Networks that integrates network control, application and device management capabilities. The system manages everything related to BYOD Bring Your Own Device from a single location. A cross-site request forgery vulnerability exists in Arub...

CVE-2018-7060

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

CVE-2017-9001

Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...

CVE-2017-9002

All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...

CVE-2018-7059

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...

CVE-2017-9001

Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user t...

CVE-2017-9002

All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...

CVE-2018-7059

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...

CVE-2018-7058

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...

CVE-2018-7058

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest...

CVE-2018-7060

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...

Privilege escalation

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when...

Cross site scripting

All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...

Cross site request forgery (csrf)

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface...