CVE-2020-7111 — Injection in Clearpass

CWE-74 — Injection3 documents3 sources

Severity

7.2HIGHNVD

EPSS

2.8%

top 13.89%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Arubanetworks Clearpass Arubanetworks Clearpass Policy Manager

Timeline

PublishedApr 16

Latest updateMay 24

Description

A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDarubanetworks/clearpass6.7.0 — 6.7.13+1

▶CVEListV5arubanetworks/clearpass_policy_managerClearPass 6.8.x prior to 6.8.5 ClearPass 6.7.x prior to 6.7.13

🔴Vulnerability Details

GHSA

GHSA-rjr6-c78c-px55: A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass↗2022-05-24

▶

CVEList

CVE-2020-7111: A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass↗2020-04-16

▶