CVE-2024-26302 — Incorrect Default Permissions in Clearpass Policy Manager
Severity
4.8MEDIUMNVD
EPSS
0.3%
top 51.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 27
Latest updateFeb 28
Description
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 2.2 | Impact: 2.5
Affected Packages2 packages
🔴Vulnerability Details
2GHSA▶
GHSA-jhxw-wgr6-6rqc: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to a↗2024-02-28
CVEList▶
CVE-2024-26302: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to a↗2024-02-27