Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• arubanetworks clearpass policy manager6.9.0 and later · before 6.9.12
• arubanetworks clearpass policy manager6.10.0 and later · before 6.10.7

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hpe). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Aruba ClearPass Policy Manager

  • 6.10.x: 6.10.6 and below, 6.9.x: 6.9.11 and belowaffected

Other highest-scoring records for the same primary product.

• CVE-2020-7115The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass.
  58Plan
• CVE-2022-23660A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below,
  41Plan
• CVE-2022-23658A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below,
  41Plan
• CVE-2022-23657A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below,
  41Plan
• CVE-2015-4650Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitra
  41Plan
• CVE-2021-40997A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x pr
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.