PT-2018-17877 · Aruba · Aruba Clearpass

Published 2018-08-06 · Updated 2018-10-18 · CVE-2018-7059

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.9

Description The issue affects the API that coordinates cluster actions, allowing an authenticated user with the mon permission to potentially obtain cluster credentials. This could lead to privilege escalation. The vulnerability is specific to users authenticated with the mon permission.

Recommendations For versions prior to 6.6.9, update to version 6.6.9 or later to resolve the issue. As a temporary workaround, consider restricting the mon permission to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-7059

Affected Products

Aruba Clearpass

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7059 · Security Note
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7059 · Vendor Advisory