« Volver al listado

CVE-2020-7111

Estado: ModificadaAlta (7.2)—

A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arubanetworks — Clearpass

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7111",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "ClearPass Policy Manager",
          "versions": [
            {
              "status": "affected",
              "version": "ClearPass 6.8.x prior to 6.8.5 ClearPass 6.7.x prior to 6.7.13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-16T19:15:34.463",
  "references": [
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-004.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution: Fixed in 6.7.13, 6.8.4, 6.9.0 and higher."
    },
    {
      "lang": "es",
      "value": "Hay una vulnerabilidad de inyección en el lado del servidor que podría permitir a un usuario administrativo autenticado lograr una Ejecución de Código Remota en ClearPass. Resolución: corregido en las versiones 6.7.13, 6.8.4, 6.9.0 y posteriores."
    }
  ],
  "lastModified": "2026-06-17T03:24:20.490",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A93E733-7F7C-45C0-A419-3474745F8CDC",
              "versionEndExcluding": "6.7.13",
              "versionStartIncluding": "6.7.0"
            },
            {
              "criteria": "cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "322D0EFF-351A-4CB3-9379-CEFE7E47F4B2",
              "versionEndExcluding": "6.8.4",
              "versionStartIncluding": "6.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}