CVE-2014-6621

Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not disable the troubleshooting and diagnostics page in production systems, which allows remote attackers to obtain version numbers, module configuration, and other sensitive information by reading the page.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/61916
http://www.arubanetworks.com/support/alerts/aid-10282014.txt	Vendor Advisory
http://secunia.com/advisories/61916
http://www.arubanetworks.com/support/alerts/aid-10282014.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arubanetworks:clearpass::::::::
	cpe:2.3:a:arubanetworks:clearpass:6.4.0:::::::*

History

21 Nov 2024, 02:14

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/61916 -~~	() http://secunia.com/advisories/61916 -
References	~~() http://www.arubanetworks.com/support/alerts/aid-10282014.txt - Vendor Advisory~~	() http://www.arubanetworks.com/support/alerts/aid-10282014.txt - Vendor Advisory

Information

Published : 2014-11-19 18:59

Updated : 2024-11-21 02:14

NVD link : CVE-2014-6621

Mitre link : CVE-2014-6621

CVE.ORG link : CVE-2014-6621

JSON object : View

Products Affected

arubanetworks

clearpass

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-6621", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-11-19T18:59:01.453", "references": [{"url": "http://secunia.com/advisories/61916", "source": "cve@mitre.org"}, {"url": "http://www.arubanetworks.com/support/alerts/aid-10282014.txt", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/61916", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.arubanetworks.com/support/alerts/aid-10282014.txt", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not disable the troubleshooting and diagnostics page in production systems, which allows remote attackers to obtain version numbers, module configuration, and other sensitive information by reading the page."}, {"lang": "es", "value": "Aruba Networks ClearPass anterior a 6.3.6 y 6.4.x anterior a 6.4.1 no deshabilita la p\u00e1gina de soluci\u00f3n de problemas y diagn\u00f3stico en los sistemas de producci\u00f3n, lo que permite a atacantes remotos obtener n\u00fameros de versi\u00f3n, la configuraci\u00f3n del m\u00f3dulo, y otra informaci\u00f3n sensible mediante la lectura de la p\u00e1gina."}], "lastModified": "2024-11-21T02:14:48.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A6BF287-CD0F-4211-949D-4E55563C57F9", "versionEndIncluding": "6.3.4"}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass:6.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7326654-1579-4464-A7FE-A3982483B104"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}