CVE-2024-26296
Assigner: hpe
Published: 2024-02-27T21:57:24.846Z
State: PUBLISHED
affected: defaultStatus: affected
product: Aruba ClearPass Policy Manager
vendor: Hewlett Packard Enterprise (HPE)
versions: status: affected
version: ClearPass Policy Manager 6.12.x: 6.12.0
status: affected
version: ClearPass Policy Manager 6.11.x: 6.11.6 and below
status: affected
version: ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below
status: affected
version: ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below
credits: type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Kajetan Rostojek (@kaje11)
descriptions: supportingMedia: base64: no
type: text/html
value: <p>Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.</p>
value: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev