Multiple vulnerabilities in Aruba ClearPass Policy Manager



Published: 2022-09-08
Risk Medium
Patch available YES
Number of vulnerabilities 14
CVE-ID CVE-2022-37878
CVE-2022-37883
CVE-2022-37882
CVE-2022-37881
CVE-2022-37880
CVE-2022-37879
CVE-2022-37877
CVE-2022-23696
CVE-2022-23695
CVE-2022-23694
CVE-2022-23693
CVE-2022-23692
CVE-2022-23685
CVE-2022-37884
CWE-ID CWE-77
CWE-264
CWE-89
CWE-352
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
ClearPass Policy Manager
Other software / Other software solutions

Vendor Aruba Networks

Security Bulletin

This security bulletin contains information about 14 vulnerabilities.

1) Command Injection

EUVDB-ID: #VU67109

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-37878

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to user arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Command Injection

EUVDB-ID: #VU67127

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-37883

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to user arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Command Injection

EUVDB-ID: #VU67126

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-37882

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to user arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Command Injection

EUVDB-ID: #VU67124

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-37881

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to user arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Command Injection

EUVDB-ID: #VU67111

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-37880

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to user arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Command Injection

EUVDB-ID: #VU67110

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-37879

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to user arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU67108

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-37877

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the ClearPass OnGuard macOS agent, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) SQL injection

EUVDB-ID: #VU67106

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-23696

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) SQL injection

EUVDB-ID: #VU67105

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-23695

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) SQL injection

EUVDB-ID: #VU67102

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-23694

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

11) SQL injection

EUVDB-ID: #VU67101

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-23693

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

12) SQL injection

EUVDB-ID: #VU67099

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-23692

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

13) Cross-site request forgery

EUVDB-ID: #VU67097

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-23685

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the web-based management interface. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

14) Input validation error

EUVDB-ID: #VU67128

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-37884

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ClearPass Policy Manager: 6.9.11 - 6.10.6


CPE2.3 External links

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###