Description
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further privileges on the ClearPass instance.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Affected products
- Hewlett Packard Enterprise (HPE) / Aruba ClearPass Policy Manager6.11.1 and below – 6.11.1 and below
- Hewlett Packard Enterprise (HPE) / Aruba ClearPass Policy Manager6.10.8 and below – 6.10.8 and below
- Hewlett Packard Enterprise (HPE) / Aruba ClearPass Policy Manager6.9.13 and below – 6.9.13 and below