CVE-2014-4013

EUVD-2014-3945
SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.9 UNKNOWN
ADJACENT_NETWORK
MEDIUM
AV:A/AC:M/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
arubanetworksclearpass
5.0.1
arubanetworksclearpass
5.1
arubanetworksclearpass
5.2
arubanetworksclearpass
6.0.1
arubanetworksclearpass
6.0.2
arubanetworksclearpass
6.1
arubanetworksclearpass
6.1.4.61696
arubanetworksclearpass
6.2
arubanetworksclearpass
6.2.6.62196
arubanetworksclearpass
6.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/58936
http://www.arubanetworks.com/support/alerts/aid-07032014.txt
http://secunia.com/advisories/58936
http://www.arubanetworks.com/support/alerts/aid-07032014.txt