PT-2022-16171 · Aruba · Aruba Clearpass Policy Manager

Published 2022-05-16 · Updated 2022-05-25 · CVE-2022-23661

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions 6.10.4 and below Aruba ClearPass Policy Manager versions 6.9.9 and below Aruba ClearPass Policy Manager versions 6.8.9-HF2 and below Aruba ClearPass Policy Manager versions 6.7.x and below

Description A remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager, which can be exploited by authenticated attackers. Aruba has released updates to address this security issue.

Recommendations For versions 6.10.4 and below, update to a version above 6.10.4. For versions 6.9.9 and below, update to a version above 6.9.9. For versions 6.8.9-HF2 and below, update to a version above 6.8.9-HF2. For versions 6.7.x and below, update to a version above 6.7.x.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-23661

Affected Products

Aruba Clearpass Policy Manager

References · 4

• https://osv.dev/vulnerability/CVE-2022-23661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23661 · Security Note
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt · Vendor Advisory
• https://t.me/cibsecurity/42785 · Telegram Post