Arubanetworks Clearpass Policy Manager vulnerabilities

CVE-2021-34615 [MEDIUM] CWE-78 CVE-2021-34615: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

CVE-2021-29151 [MEDIUM] CVE-2021-29151: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager versio A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

CVE-2021-34614 [MEDIUM] CWE-78 CVE-2021-34614: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

CVE-2021-34613 [MEDIUM] CWE-78 CVE-2021-34613: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

CVE-2021-29152 [MEDIUM] CVE-2021-29152: A remote denial of service (DoS) vulnerability was discovered in Aruba ClearPass Policy Manager vers A remote denial of service (DoS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

CVE-2021-34616 [MEDIUM] CWE-78 CVE-2021-34616: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.

CVE-2020-7123 [HIGH] CVE-2020-7123: A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager versi A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.

CVE-2021-26680 [HIGH] CWE-78 CVE-2021-26680: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26679 [HIGH] CWE-78 CVE-2021-26679: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26677 [HIGH] CVE-2021-26677: A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users on a Windows platform to elevate their privileges. A successful exploit could allow an attacker to execute arbitrary code with

CVE-2021-26684 [HIGH] CWE-78 CVE-2021-26684: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26683 [HIGH] CWE-78 CVE-2021-26683: A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to exe

CVE-2021-26681 [HIGH] CWE-78 CVE-2021-26681: A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Mana A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the ClearPass CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary command

CVE-2021-26678 [MEDIUM] CWE-79 CVE-2021-26678: A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba Cle A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface of ClearPass could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an

CVE-2021-26686 [MEDIUM] CWE-89 CVE-2021-26686: A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could e

CVE-2021-26682 [MEDIUM] CWE-79 CVE-2021-26682: A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the portal. A successful exp

CVE-2020-7120 [MEDIUM] CWE-120 CVE-2020-7120: A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users to cause a buffer overflow condition. A successful exploit could allow a local attacker to execute arbitrary code within the c

CVE-2021-26685 [MEDIUM] CWE-89 CVE-2021-26685: A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface API of ClearPass could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass instance. An attacker could e

CVE-2020-7115 [CRITICAL] CWE-306 CVE-2020-7115: The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authenticati The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.

CVE-2020-7117 [HIGH] CVE-2020-7117: The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote exec The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.