CVE-2023-43509

EUVD-2023-47915
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
hpeCNA
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
arubanetworksclearpass_policy_manager
𝑥
< 6.9.13
arubanetworksclearpass_policy_manager
6.10.0 ≤
𝑥
< 6.10.8
arubanetworksclearpass_policy_manager
6.11.0 ≤
𝑥
≤ 6.11.4
arubanetworksclearpass_policy_manager
6.9.13
arubanetworksclearpass_policy_manager
6.9.13:cumulative_hotfix_patch_2
arubanetworksclearpass_policy_manager
6.9.13:cumulative_hotfix_patch_3
arubanetworksclearpass_policy_manager
6.10.8
arubanetworksclearpass_policy_manager
6.10.8:cumulative_hotfix_patch_2
arubanetworksclearpass_policy_manager
6.10.8:cumulative_hotfix_patch_5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt