CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26685
https://notcve.org/view.php?id=CVE-2021-26685
A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database. Se detectó una vulnerabilidad de inyección SQL autenticada remota en Aruba ClearPass Policy Manager: versiones anteriores a 6.9.5, 6.8.8-HF1, 6.7.14-HF1. Una vulnerabilidad en la API de la interfaz de administración basada en web de ClearPass podría permitir a un atacante remoto autenticado conducir ataques de inyección SQL contra la instancia de ClearPass. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7079
https://notcve.org/view.php?id=CVE-2018-7079
Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privilege users to view, modify, or delete guest users. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix. Error de autorización de invitados en Aruba ClearPass Policy Manager. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7063
https://notcve.org/view.php?id=CVE-2018-7063
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts. En Aruba ClearPass, los administradores de la API deshabilitados pueden seguir realizando operaciones de lectura/escritura. En ciertas circunstancias, los administradores de la API en ClearPass que han sido deshabilitados podrían seguir siendo capaces de realizar operaciones de lectura/escritura en partes de la API XML. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7066
https://notcve.org/view.php?id=CVE-2018-7066
An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings. Resolution: Fixed in 6.7.5 and 6.6.10-hotfix. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7065
https://notcve.org/view.php?id=CVE-2018-7065
An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass are affected by multiple authenticated SQL injection vulnerabilities. In each case, an authenticated administrative user of any type could exploit this vulnerability to gain access to "appadmin" credentials, leading to complete cluster compromise. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix. Una vulnerabilidad de inyección SQL autenticada en Aruba ClearPass Policy Manager puede conducir al escalado de privilegios. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •