6.3

CVE-2023-43510

A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a non-privileged user on the underlying operating system leading to partial system compromise.

Data is provided by the National Vulnerability Database (NVD)
Arubanetworks ≫ Clearpass Policy Manager Version >= 6.10.0 < 6.10.8
Arubanetworks ≫ Clearpass Policy Manager Version >= 6.11.0 <= 6.11.4
Arubanetworks ≫ Clearpass Policy Manager Version6.9.13 Update-
Arubanetworks ≫ Clearpass Policy Manager Version6.9.13 Updatecumulative_hotfix_patch_2
Arubanetworks ≫ Clearpass Policy Manager Version6.9.13 Updatecumulative_hotfix_patch_3
Arubanetworks ≫ Clearpass Policy Manager Version6.10.8 Update-
Arubanetworks ≫ Clearpass Policy Manager Version6.10.8 Updatecumulative_hotfix_patch_2
Arubanetworks ≫ Clearpass Policy Manager Version6.10.8 Updatecumulative_hotfix_patch_5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.29% 0.494
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
security-alert@hpe.com 4.7 1.2 3.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.