CVE-2022-23696

Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt	Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::
	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::

History

21 Nov 2024, 06:49

Type	Values Removed	Values Added
References	~~() https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt - Vendor Advisory~~	() https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt - Vendor Advisory

Information

Published : 2022-09-20 21:15

Updated : 2024-11-21 06:49

NVD link : CVE-2022-23696

Mitre link : CVE-2022-23696

CVE.ORG link : CVE-2022-23696

JSON object : View

Products Affected

arubanetworks

clearpass_policy_manager

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2022-23696", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-09-20T21:15:10.293", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}, {"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities."}, {"lang": "es", "value": "Unas vulnerabilidades en la interfaz de administraci\u00f3n basada en la web de ClearPass Policy Manager podr\u00edan permitir a un atacante remoto autenticado conducir ataques de inyecci\u00f3n SQL contra la instancia de ClearPass Policy Manager. Un atacante podr\u00eda explotar estas vulnerabilidades para obtener y modificar informaci\u00f3n confidencial en la base de datos subyacente, lo que podr\u00eda conllevar a un compromiso completo del cl\u00faster de ClearPass Policy Manager en Aruba ClearPass Policy Manager versi\u00f3n(es): 6.10.x: 6.10.6 y anteriores; 6.9.x: 6.9.11 y anteriores. Aruba ha publicado actualizaciones para Aruba ClearPass Policy Manager que abordan estas vulnerabilidades de seguridad"}], "lastModified": "2024-11-21T06:49:07.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57F180BC-B95D-4B3A-9C1C-38611C4B80C6", "versionEndExcluding": "6.9.12", "versionStartIncluding": "6.9.0"}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327E889C-2867-4E82-AB1A-2D47735D5EF5", "versionEndExcluding": "6.10.7", "versionStartIncluding": "6.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}