CVE-2017-9002: All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can…

PriorityP423medium6.1CVSS 3.0

AVNACLPRNUIRSCCLILAN

EPSS

0.92%

55.8th percentile

All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into ClearPass in the same browser.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
hewlett_packard_enterprise	aruba_clearpass	—	—
hp	aruba_clearpass_policy_manager	< 6.6.8	6.6.8

CVSS provenance

nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.