CVE-2023-43509 — Cross-site Scripting in Clearpass Policy Manager

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.8MEDIUMNVD
EPSS
0.3%
top 48.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Arubanetworks Clearpass Policy ManagerHewlett Packard Enterprise Aruba Clearpass Policy Manager
Timeline
PublishedOct 25

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5hewlett_packard_enterprise/aruba_clearpass_policy_managerClearPass Policy Manager 6.11.x: 6.11.4 and below — <=6.11.4+2

🔴Vulnerability Details

2
GHSA
GHSA-55jf-4cm3-v6wp: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications↗2023-10-25
▶
CVEList
Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications↗2023-10-24
▶
CVE-2023-43509 — Cross-site Scripting | cvebase