PT-2014-7305 · Aruba Networks · Clearpass

Published 2014-11-19 · Updated 2014-11-19 · CVE-2014-6621

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aruba Networks ClearPass versions prior to 6.3.6 Aruba Networks ClearPass versions 6.4.x prior to 6.4.1

Description The issue allows remote attackers to obtain sensitive information, including version numbers and module configuration, by accessing the troubleshooting and diagnostics page, which is not disabled in production systems.

Recommendations For versions prior to 6.3.6, update to version 6.3.6 or later to resolve the issue. For versions 6.4.x prior to 6.4.1, update to version 6.4.1 or later to resolve the issue. As a temporary workaround, consider disabling access to the troubleshooting and diagnostics page to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-6621

Affected Products

Clearpass

References · 3

• http://arubanetworks.com/support/alerts/aid-10282014.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6621 · Security Note
• http://secunia.com/advisories/61916 · Note