CVE-2022-43535 — Improper Privilege Management in Clearpass Policy Manager

CWE-269 — Improper Privilege Management3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 71.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Arubanetworks Clearpass Policy ManagerHewlett Packard Enterprise Aruba Clearpass Policy Manager
Timeline
PublishedJan 5

Description

A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with NT AUTHORITY\SYSTEM level privileges on the Windows instance in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x: 6.9.12 and below.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5hewlett_packard_enterprise/aruba_clearpass_policy_managerClearPass Policy Manager 6.10.x: 6.10.7 and below, ClearPass Policy Manager 6.9.x: 6.9.12 and below

🔴Vulnerability Details

2
GHSA
GHSA-jmx6-gw67-2vg8: A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges↗2023-01-05
▶
CVEList
CVE-2022-43535: A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges↗2023-01-03
▶
CVE-2022-43535 — Improper Privilege Management | cvebase