CVE-2020-7114 — Missing Authentication for Critical Function in Clearpass

CWE-306 — Missing Authentication for Critical Function3 documents3 sources

Severity

9.8CRITICALNVD

EPSS

0.4%

top 38.03%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Arubanetworks Clearpass Arubanetworks Clearpass Policy Manager

Timeline

PublishedApr 16

Latest updateMay 24

Description

A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in ClearPass by crafting HTTP packets. As a result of this attack, a possible complete cluster compromise might occur. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDarubanetworks/clearpass6.7.0 — 6.7.13+1

▶CVEListV5arubanetworks/clearpass_policy_managerClearPass 6.8.x prior to 6.8.5 ClearPass 6.7.x prior to 6.7.13

🔴Vulnerability Details

GHSA

GHSA-m8j6-cx9x-6pxx: A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain dat↗2022-05-24

▶

CVEList

CVE-2020-7114: A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain dat↗2020-04-16

▶