CVE-2023-43509

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
arubanetworksclearpass_policy_manager
𝑥
< 6.9.13
arubanetworksclearpass_policy_manager
6.10.0 ≤
𝑥
< 6.10.8
arubanetworksclearpass_policy_manager
6.11.0 ≤
𝑥
≤ 6.11.4
arubanetworksclearpass_policy_manager
6.9.13
arubanetworksclearpass_policy_manager
6.9.13:cumulative_hotfix_patch_2
arubanetworksclearpass_policy_manager
6.9.13:cumulative_hotfix_patch_3
arubanetworksclearpass_policy_manager
6.10.8
arubanetworksclearpass_policy_manager
6.10.8:cumulative_hotfix_patch_2
arubanetworksclearpass_policy_manager
6.10.8:cumulative_hotfix_patch_5
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
hpearuba_clear_pass_policy_manager
6.11x ≤
𝑥
≤ 6.11.4
ADP
hpearuba_clear_pass_policy_manager
6.10x ≤
𝑥
< 6.10.8
ADP
hpearuba_clear_pass_policy_manager
6.9x ≤
𝑥
< 6.9.13
ADP
Common Weakness Enumeration
References
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt