PT-2018-8489 · Aruba · Aruba Clearpass

Publicado 2018-08-06 · Atualizado 2018-10-18 · CVE-2017-9002

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.8

Description The issue allows an attacker to obtain sensitive information, such as session cookies or passwords, by tricking a logged-in administrative user into clicking a malicious link. This can happen when the administrative user is currently logged into the system in the same browser.

Recommendations For versions prior to 6.6.8, update to version 6.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative functions to minimize the risk of exploitation. Avoid clicking on suspicious links while logged into the ClearPass administrative interface.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-9002

Produtos afetados

Aruba Clearpass

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9002 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9002 · Aviso do Fabricante
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2017-004.txt · Aviso do Fabricante