PT-2018-17877 · Aruba · Aruba Clearpass

Publicado 2018-08-06 · Atualizado 2018-10-18 · CVE-2018-7059

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.9

Description The issue affects the API that coordinates cluster actions, allowing an authenticated user with the mon permission to potentially obtain cluster credentials. This could lead to privilege escalation. The vulnerability is specific to users authenticated with the mon permission.

Recommendations For versions prior to 6.6.9, update to version 6.6.9 or later to resolve the issue. As a temporary workaround, consider restricting the mon permission to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-7059

Produtos afetados

Aruba Clearpass

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7059 · Nota de Segurança
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-7059 · Aviso do Fabricante