PT-2018-8489 · Aruba · Aruba Clearpass

Published 2018-08-06 · Updated 2018-10-18 · CVE-2017-9002

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Aruba ClearPass versions prior to 6.6.8

Description The issue allows an attacker to obtain sensitive information, such as session cookies or passwords, by tricking a logged-in administrative user into clicking a malicious link. This can happen when the administrative user is currently logged into the system in the same browser.

Recommendations For versions prior to 6.6.8, update to version 6.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative functions to minimize the risk of exploitation. Avoid clicking on suspicious links while logged into the ClearPass administrative interface.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9002

Affected Products

Aruba Clearpass

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9002 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9002 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2017-004.txt · Vendor Advisory