Stored cross-site scripting in ClearPass Policy Manager - CVE-2024-26299
Published: May 29, 2024
Vulnerability identifier: #VU89889
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-26299
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Admin interface. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
ClearPass Policy Manager
Aruba Networking ClearPass Policy Manager
Aruba Networking ClearPass Policy Manager
How to mitigate CVE-2024-26299
Install update from vendor's website.
ClearPass Policy Manager - addressed in versions 6.9.13 Hotfix Patch 7, 6.10.8 Hotfix Patch 8, 6.11.7, 6.12.1
Aruba Networking ClearPass Policy Manager - addressed in versions 6.9.13 Hotfix Patch 7 Q1 2024, 6.10.8 Hotfix Patch 8 Q1 2024, 6.11.7, 6.12.1
Aruba Networking ClearPass Policy Manager - addressed in versions 6.9.13 Hotfix Patch 7 Q1 2024, 6.10.8 Hotfix Patch 8 Q1 2024, 6.11.7, 6.12.1