« Volver al listado

CVE-2014-2593

Estado: ModificadaAlta (9)—

The management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command, as demonstrated by the (1) system status-rasession and (2) network ping commands.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arubanetworks — Clearpass Policy Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-2593",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-08-29T13:55:04.283",
  "references": [
    {
      "url": "http://osvdb.org/show/osvdb/109662",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.arubanetworks.com/support/alerts/aid-050214.asc",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/69391",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95491",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2593",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/show/osvdb/109662",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.arubanetworks.com/support/alerts/aid-050214.asc",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/69391",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95491",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2593",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command, as demonstrated by the (1) system status-rasession and (2) network ping commands."
    },
    {
      "lang": "es",
      "value": "La consola de gestión en Aruba Networks ClearPass Policy Manager 6.3.0.60730 permite a usuarios locales ejecutar comandos arbitrarios a través de metacaracteres de shell en ciertos argumentos de un comando válido como fue demostrado por (1) la rasesión del estado de los sistemas y (2) los comandos ping de la red."
    }
  ],
  "lastModified": "2026-06-17T00:06:51.327",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.3.0.60730:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C00EC8C7-1C40-4197-BB10-10AAABC25496"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Per: http://osvdb.org/show/osvdb/109662\n\n\"Aruba Networks ClearPass Policy Manager contains a flaw in the Management console. The issue is triggered when parsing commands. With a specially crafted command, an authenticated remote attacker can execute arbitrary commands with root privileges.\"",
  "sourceIdentifier": "cve@mitre.org"
}