CVE-2022-43532 — Cross-site Scripting in Clearpass Policy Manager

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.8MEDIUMNVD
CNA8.0
EPSS
0.3%
top 47.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Arubanetworks Clearpass Policy ManagerHewlett Packard Enterprise Aruba Clearpass Policy Manager
Timeline
PublishedJan 5

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x: 6.…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5hewlett_packard_enterprise/aruba_clearpass_policy_managerClearPass Policy Manager 6.10.x: 6.10.7 and below, ClearPass Policy Manager 6.9.x: 6.9.12 and below

🔴Vulnerability Details

2
GHSA
GHSA-v7r3-qrh4-2xr2: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cro↗2023-01-05
▶
CVEList
CVE-2022-43532: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cro↗2023-01-03
▶
CVE-2022-43532 — Cross-site Scripting | cvebase