Cross-site scripting in ClearPass Policy Manager - CVE-2024-26300
Published: May 29, 2024
Vulnerability identifier: #VU89890
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-26300
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Guest interface. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
ClearPass Policy Manager
Aruba Networking ClearPass Policy Manager
Aruba Networking ClearPass Policy Manager
How to mitigate CVE-2024-26300
Install update from vendor's website.
ClearPass Policy Manager - addressed in versions 6.9.13 Hotfix Patch 7, 6.10.8 Hotfix Patch 8, 6.11.7, 6.12.1
Aruba Networking ClearPass Policy Manager - addressed in versions 6.9.13 Hotfix Patch 7 Q1 2024, 6.10.8 Hotfix Patch 8 Q1 2024, 6.11.7, 6.12.1
Aruba Networking ClearPass Policy Manager - addressed in versions 6.9.13 Hotfix Patch 7 Q1 2024, 6.10.8 Hotfix Patch 8 Q1 2024, 6.11.7, 6.12.1