CVE-2024-26295

EUVD-2024-23566
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 51%
Affected Products (NVD)
VendorProductVersion
arubanetworksclearpass_policy_manager
6.9.0 ≤
𝑥
< 6.9.13
arubanetworksclearpass_policy_manager
6.10.0 ≤
𝑥
< 6.10.8
arubanetworksclearpass_policy_manager
6.11.0 ≤
𝑥
≤ 6.11.6
arubanetworksclearpass_policy_manager
6.9.13
arubanetworksclearpass_policy_manager
6.9.13:cumulative_hotfix_patch_2
arubanetworksclearpass_policy_manager
6.9.13:cumulative_hotfix_patch_3
arubanetworksclearpass_policy_manager
6.9.13:cumulative_hotfix_patch_4
arubanetworksclearpass_policy_manager
6.10.8
arubanetworksclearpass_policy_manager
6.10.8:cumulative_hotfix_patch_2
arubanetworksclearpass_policy_manager
6.10.8:cumulative_hotfix_patch_5
arubanetworksclearpass_policy_manager
6.10.8:cumulative_hotfix_patch_6
arubanetworksclearpass_policy_manager
6.12.0
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
arubanetworksclearpass_policy_manager
6.11.0 ≤
𝑥
≤ 6.11.6
ADP
arubanetworksclearpass_policy_manager
6.10.0 ≤
𝑥
≤ 6.10.8_hotfix_q4_2023
ADP
arubanetworksclearpass_policy_manager
6.9.0 ≤
𝑥
≤ 6.9.13_hotfix_q4_2023
ADP
Common Weakness Enumeration
References
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt