PT-2020-19384 · Aruba · Clearpass Policy Manager

Published 2020-06-03 · Updated 2020-06-04 · CVE-2020-7117

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions prior to 6.7.13-HF Aruba ClearPass Policy Manager versions prior to 6.8.5-HF Aruba ClearPass Policy Manager versions prior to 6.8.6 Aruba ClearPass Policy Manager versions prior to 6.9.1

Description The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution issue. When an attacker is already authenticated to the administrative interface, they could exploit the system, leading to remote command execution in the underlying operating system.

Recommendations For versions prior to 6.7.13-HF, update to 6.7.13-HF or higher. For versions prior to 6.8.5-HF, update to 6.8.5-HF or higher. For versions prior to 6.8.6, update to 6.8.6 or higher. For versions prior to 6.9.1, update to 6.9.1 or higher.

Fix

Related Identifiers

CVE-2020-7117

Affected Products

Clearpass Policy Manager

References · 3

• https://osv.dev/vulnerability/CVE-2020-7117 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7117 · Security Note