Hewlett Packard Enterprise Aruba ClearPass
At a glance
- Source
- NVD
- EPSS
- EPSS 0.46 % · percentile 40 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Modified
Description
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.
Weaknesses (CWE)
- CWE-352 — Cross-Site Request Forgery
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-18803
- GCVE · GCVE-0-2018-7060
CERT-FR advisories
- CERTFR-2018-AVI-144 — Multiples vulnérabilités dans Aruba ClearPass · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*≥ 6.6.0 < 6.6.9cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*≥ 6.7.0 < 6.7.1
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise · Aruba ClearPass | affected 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |