Aruba ClearPass Policy Manager up to 6.7.x/6.8.9-HF2/6.9.9/6.10.4 command injection

Summaryinfo

A vulnerability identified as critical has been detected in Aruba ClearPass Policy Manager up to 6.7.x/6.8.9-HF2/6.9.9/6.10.4. Impacted is an unknown function. The manipulation leads to command injection. This vulnerability is referenced as CVE-2022-23661. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Aruba ClearPass Policy Manager up to 6.7.x/6.8.9-HF2/6.9.9/6.10.4 (Policy Management Software) and classified as critical. This issue affects some unknown functionality. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability.

The weakness was published 05/17/2022 as ARUBA-PSA-2022-007. The advisory is shared at arubanetworks.com. The identification of this vulnerability is CVE-2022-23661 since 01/19/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• Aruba

Name

• ClearPass Policy Manager

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8.9-HF2
• 6.9.0
• 6.9.1
• 6.9.2
• 6.9.3
• 6.9.4
• 6.9.5
• 6.9.6
• 6.9.7
• 6.9.8
• 6.9.9
• 6.10.0
• 6.10.1
• 6.10.2
• 6.10.3
• 6.10.4

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion