CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-7116
https://notcve.org/view.php?id=CVE-2020-7116
The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz administrativa de ClearPass Policy Manager WebUI, presenta una ejecución de comando remota autenticado. Cuando el atacante ya está autenticado en la interfaz administrativa, podría explotar el sistema, conllevando a una ejecución de comando remota en el sistema operativo subyacente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-7117
https://notcve.org/view.php?id=CVE-2020-7117
The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz administrativa de ClearPass Policy Manager WebUI, presenta una ejecución de comando remota autenticada. Cuando el atacante ya está autenticado en la interfaz administrativa, podría explotar el sistema, conllevando a una ejecución de comando remota en el sistema operativo subyacente. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt •
CVSS: 10.0EPSS: 94%CPEs: 3EXPL: 3CVE-2020-7115 – Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution
https://notcve.org/view.php?id=CVE-2020-7115
The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. La interfaz web de ClearPass Policy Manager está afectada por una vulnerabilidad que conlleva a una omisión de autenticación. Luego de una omisión con éxito, un atacante podría ejecutar una explotación que permitiría una ejecución de comando remota en el sistema operativo subyacente. • https://www.exploit-db.com/exploits/48661 https://github.com/Retr02332/CVE-2020-7115 http://packetstormsecurity.com/files/158368/ClearPass-Policy-Manager-Unauthenticated-Remote-Command-Execution.html https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7079
https://notcve.org/view.php?id=CVE-2018-7079
Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privilege users to view, modify, or delete guest users. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix. Error de autorización de invitados en Aruba ClearPass Policy Manager. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-7063
https://notcve.org/view.php?id=CVE-2018-7063
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts. En Aruba ClearPass, los administradores de la API deshabilitados pueden seguir realizando operaciones de lectura/escritura. En ciertas circunstancias, los administradores de la API en ClearPass que han sido deshabilitados podrían seguir siendo capaces de realizar operaciones de lectura/escritura en partes de la API XML. • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt • CWE-611: Improper Restriction of XML External Entity Reference •