Hewlett Packard Enterprise Aruba ClearPass
En bref
- Source
- NVD
- EPSS
- EPSS 3.89 % · centile 90 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Modified
Description
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest captive portal, and API. Customers who do not expose ClearPass web interfaces to untrusted users are impacted to a lesser extent.
Faiblesses (CWE)
- CWE-287 — Authentification incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-18801
- GCVE · GCVE-0-2018-7058
Avis du CERT-FR
- CERTFR-2018-AVI-144 — Multiples vulnérabilités dans Aruba ClearPass · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:hp:aruba_clearpass_policy_manager:*:*:*:*:*:*:*:*≥ 6.6.0 < 6.6.9
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise · Aruba ClearPass | affected 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |