PT-2022-16183 · Aruba · Aruba Clearpass Policy Manager

Published 2022-05-17 · Updated 2023-08-08 · CVE-2022-23672

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions 6.10.4 and below Aruba ClearPass Policy Manager versions 6.9.9 and below Aruba ClearPass Policy Manager versions 6.8.9-HF2 and below Aruba ClearPass Policy Manager versions 6.7.x and below

Description A remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager. This issue allows for authenticated remote command injection. Aruba has released updates to address this security issue.

Recommendations For versions 6.10.4 and below, update to a version above 6.10.4. For versions 6.9.9 and below, update to a version above 6.9.9. For versions 6.8.9-HF2 and below, update to a version above 6.8.9-HF2. For versions 6.7.x and below, update to a version above 6.7.x.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-23672

Affected Products

Aruba Clearpass Policy Manager

References · 6

• https://osv.dev/vulnerability/CVE-2022-23672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23672 · Security Note
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt · Vendor Advisory
• https://t.me/cvenotify/30333 · Telegram Post
• https://t.me/cvenotify/35621 · Telegram Post
• https://t.me/cibsecurity/42861 · Telegram Post