« Volver al listado

CVE-2024-26302

Estado: AnalizadaMedia (4.8)—

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arubanetworks — Clearpass Policy Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-26302",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-26302",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-28T18:11:03.319147Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-alert@hpe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "product": "Aruba ClearPass Policy Manager",
          "versions": [
            {
              "status": "affected",
              "version": "ClearPass Policy Manager 6.12.x: 6.12.0"
            },
            {
              "status": "affected",
              "version": "ClearPass Policy Manager 6.11.x: 6.11.6 and below"
            },
            {
              "status": "affected",
              "version": "ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below"
            },
            {
              "status": "affected",
              "version": "ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-02-27T23:15:07.627",
  "references": [
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt",
      "tags": [
        "Broken Link"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.\n\n"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de administración basada en web de ClearPass Policy Manager podría permitir que un atacante remoto autenticado con privilegios bajos acceda a información confidencial. Un exploit exitoso permite a un atacante recuperar información que podría usarse para obtener acceso adicional a los servicios de red compatibles con ClearPass Policy Manager."
    }
  ],
  "lastModified": "2026-06-17T07:17:34.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FB4B104-2BBB-4F41-8245-97616A66C18B",
              "versionEndExcluding": "6.9.13",
              "versionStartIncluding": "6.9.0"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84F5E56D-039C-47B0-827A-AFE34887DAD2",
              "versionEndExcluding": "6.10.8",
              "versionStartIncluding": "6.10.0"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B615E4D-D615-4AA4-B501-E9BA06A1D909",
              "versionEndIncluding": "6.11.6",
              "versionStartIncluding": "6.11.0"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57C5BF92-A455-44E4-AE20-F9A1D790422D"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7962FD34-6A38-461A-8942-BCA227AF8AF9"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "435A3CE6-AB76-4F4F-B11F-71E0C7619A9A"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48AF4969-0D31-4109-B925-E22FF9742F00"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DB2448F-D014-4672-90A9-3BCC91096B93"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80F47102-7F9F-449F-91A1-76372AA7F3D4"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F85708F3-CA05-472A-9B51-373D1AD14E9C"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2700588C-FBC3-4A45-A482-1168D965AAA3"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9DC2CA8-B27E-48A8-BD73-A5CE9A55B6FA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}