CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Permissions Privileges and Access Controls
Summary: the management console in aruba networks clearpass policy manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command, as demonstrated by the (1) system status-rasession and (2) network ping commands. per: http://osvdb.org/show/osvdb/109662

"aruba networks clearpass policy manager contains a flaw in the management console. the issue is triggered when parsing commands. with a specially crafted command, an authenticated remote attacker can execute arbitrary commands with root privileges."
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2014-08-29
Last Modified Date: 2017-08-29