Arubanetworks Clearpass Policy Manager vulnerabilities

CVE-2022-23669 [HIGH] CWE-613 CVE-2022-23669: A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

CVE-2021-26680 [HIGH] CWE-78 CVE-2021-26680: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26679 [HIGH] CWE-78 CVE-2021-26679: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26684 [HIGH] CWE-78 CVE-2021-26684: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26683 [HIGH] CWE-78 CVE-2021-26683: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26681 [HIGH] CWE-78 CVE-2021-26681: A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary command

CVE-2022-23685 [HIGH] CWE-352 CVE-2022-23685: A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against these endpoints if the attacker can convince an authenticated user of the interface to interac

CVE-2020-7116 [HIGH] CVE-2020-7116: The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote exec The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.

CVE-2020-7117 [HIGH] CVE-2020-7117: The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote exec The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.

CVE-2021-40993 [HIGH] CWE-89 CVE-2021-40993: A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Cl A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.

CVE-2024-51772 [HIGH] CWE-77 CVE-2024-51772: An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface al An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2022-37879 [HIGH] CWE-77 CVE-2022-37879: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager ve

CVE-2022-37878 [HIGH] CWE-78 CVE-2022-37878: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager ve

CVE-2022-37882 [HIGH] CWE-78 CVE-2022-37882: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager ve

CVE-2022-37880 [HIGH] CWE-78 CVE-2022-37880: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager ve

CVE-2022-37883 [HIGH] CWE-77 CVE-2022-37883: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager ve

CVE-2022-37881 [HIGH] CWE-77 CVE-2022-37881: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager ve

CVE-2015-1550 [CRITICAL] CWE-22 CVE-2015-1550: Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 all Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors.

CVE-2014-6628 [CRITICAL] CVE-2014-6628: Aruba Networks ClearPass Policy Manager (CPPM) before 6.5.0 allows remote administrators to execute Aruba Networks ClearPass Policy Manager (CPPM) before 6.5.0 allows remote administrators to execute arbitrary code via unspecified vectors.

CVE-2021-37739 [HIGH] CWE-77 CVE-2021-37739: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vul