PT-2021-17087 · Aruba · Aruba Clearpass Policy Manager

Published 2021-02-23 · Updated 2021-02-26 · CVE-2021-26682

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions prior to 6.9.5 Aruba ClearPass Policy Manager version 6.8.8-HF1 Aruba ClearPass Policy Manager version 6.7.14-HF1

Description A remote reflected cross-site scripting (XSS) vulnerability was discovered in the guest portal interface of Aruba ClearPass Policy Manager. This vulnerability could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the portal. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the guest portal interface.

Recommendations For versions prior to 6.9.5, update to version 6.9.5 or later. For version 6.8.8-HF1, update to a version that includes the fix for this issue. For version 6.7.14-HF1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the guest portal interface until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-26682

Affected Products

Aruba Clearpass Policy Manager

References · 5

• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26682 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26682 · Vendor Advisory
• https://t.me/cibsecurity/24016 · Telegram Post
• https://t.me/cvenotify/10371 · Telegram Post