HPE Aruba Networking ClearPass Policy Manager: Stored XSS Vulnerability in Web Interface
CVE-2024-51773 Published on December 3, 2024
Authenticated Stored Cross-Site Scripting (XSS) in HPE Aruba Networking ClearPass Policy Manager Web-based Management Interface
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session.
Vulnerability Analysis
CVE-2024-51773 can be exploited with network access, requires user interaction and user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2024-51773 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2024-51773
stack.watch emails you whenever new vulnerabilities are published in Aruba Networks Clearpass or Aruba Networks Clearpass Policy Manager. Just hit a watch button to start following.
Affected Versions
Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager:- Version 6.12.0, <= 6.12.2 is affected.
- Version 6.11.0, <= 6.11.9 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.