CVE-2023-43509

Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications

State: Published
Severity: 5.8 Medium
Published: Oct 24, 2023
Updated: Sep 11, 2024
Reserved: Sep 19, 2023

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N	hpe

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Aruba ClearPass Policy ManagerHewlett Packard Enterprise (HPE)	ClearPass Policy Manager 6.11.x: 6.11.4 and below through <=6.11.4Affected ClearPass Policy Manager 6.10.x: 6.10.8 with ClearPass 6.10.8 Cumulative Hotfix Patch 5 and belowAffected ClearPass Policy Manager 6.9.x: 6.9.13 with ClearPass 6.9.13 Cumulative Hotfix Patch 3 and belowAffected

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.