DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Aruba ClearPass Policy Manager: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-12-06
Ein Angreifer kann mehrere Schwachstellen in Aruba ClearPass Policy Manager ausnutzen, um SQL Injection- und Cross Site Scripting Angriffe durchzuführen, Code zur Ausführung zu bringen, seine Rechte zu erweitern oder Informationen offenzulegen.
01
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-43540US | medium5.5 | — | ||
A vulnerability exists in the ClearPass OnGuard macOS agent that allows for an attacker with local macOS instance access to potentially obtain sensitive information. A successful e… | ||||
| CVE-2022-43539US | medium4.5 | — | ||
A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position to potentially obtain sensitive informati… | ||||
| CVE-2022-43538US | high7.2 | — | ||
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploit… | ||||
| CVE-2022-43537US | high7.2 | — | ||
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploit… | ||||
| CVE-2022-43536US | high8.8 | — | ||
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploit… | ||||
| CVE-2022-43535US | high7.8 | — | ||
A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. A successful exploit could allow these us… | ||||
| CVE-2022-43534US | high7.8 | — | ||
A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit could allow these users… | ||||
| CVE-2022-43533US | high7.8 | — | ||
A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit could allow these users… | ||||
| CVE-2022-43532US | medium4.8 | — | ||
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attac… | ||||
| CVE-2022-43531US | high8.8 | — | ||
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPa… | ||||
| CVE-2022-43530US | high8.8 | — | ||
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPas… | ||||
| CVE-2002-20001US | high7.5 | Exploit | ||
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-s… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan