CVE-2024-26302 - Vulnerability Details

Vendors	Products
Arubanetworks	Clearpass Policy Manager

Link	Providers
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt

Type	Values Removed	Values Added
First Time appeared		Arubanetworks Arubanetworks clearpass Policy Manager
CPEs		cpe:2.3:a:arubanetworks:clearpass_policy_manager:::::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-:::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2:::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5:::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_6:::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.12.0:::::::* cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-:::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2:::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3:::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_4::::::
Vendors & Products		Arubanetworks Arubanetworks clearpass Policy Manager

Type	Values Removed	Values Added
Weaknesses		CWE-276
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26302", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2024-02-16T19:42:43.186Z", "datePublished": "2024-02-27T22:11:37.929Z", "dateUpdated": "2024-11-05T15:10:37.462Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Aruba ClearPass Policy Manager", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "ClearPass Policy Manager 6.12.x: 6.12.0"}, {"status": "affected", "version": "ClearPass Policy Manager 6.11.x: 6.11.6 and below"}, {"status": "affected", "version": "ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below"}, {"status": "affected", "version": "ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Aruba ClearPass Policy Manager engineering team"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.</p>"}], "value": "A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-02-27T22:11:37.929Z"}, "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-276", "lang": "en", "description": "CWE-276 Incorrect Default Permissions"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-28T18:11:03.319147Z", "id": "CVE-2024-26302", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T15:10:37.462Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.011Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-26302 (string)

assignerOrgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

state : PUBLISHED (string)

assignerShortName : hpe (string)

dateReserved : 2024-02-16T19:42:43.186Z (string)

datePublished : 2024-02-27T22:11:37.929Z (string)

dateUpdated : 2024-11-05T15:10:37.462Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : affected (string)

product : Aruba ClearPass Policy Manager (string)

vendor : Hewlett Packard Enterprise (HPE) (string)

versions : [ »

0 : { »

status : affected (string)

version : ClearPass Policy Manager 6.12.x: 6.12.0 (string)

}

1 : { »

status : affected (string)

version : ClearPass Policy Manager 6.11.x: 6.11.6 and below (string)

}

2 : { »

status : affected (string)

version : ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below (string)

}

3 : { »

status : affected (string)

version : ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Aruba ClearPass Policy Manager engineering team (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <p>A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.</p> (string)

}

]

value : A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

providerMetadata : { »

orgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

shortName : hpe (string)

dateUpdated : 2024-02-27T22:11:37.929Z (string)

}

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-276 (string)

lang : en (string)

description : CWE-276 Incorrect Default Permissions (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.8 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-02-28T18:11:03.319147Z (string)

id : CVE-2024-26302 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-05T15:10:37.462Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T00:07:19.011Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.011Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-26302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-28T18:11:03.319147Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:13.550Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Aruba ClearPass Policy Manager engineering team"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "Aruba ClearPass Policy Manager", "versions": [{"status": "affected", "version": "ClearPass Policy Manager 6.12.x: 6.12.0"}, {"status": "affected", "version": "ClearPass Policy Manager 6.11.x: 6.11.6 and below"}, {"status": "affected", "version": "ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below"}, {"status": "affected", "version": "ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-02-27T22:11:37.929Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26302", "state": "PUBLISHED", "dateUpdated": "2024-11-05T15:10:37.462Z", "dateReserved": "2024-02-16T19:42:43.186Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2024-02-27T22:11:37.929Z", "assignerShortName": "hpe"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T00:07:19.011Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.8 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-26302 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-02-28T18:11:03.319147Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-276 (string)

description : CWE-276 Incorrect Default Permissions (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-05-23T19:01:13.550Z (string)

}

]

cna : { »

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Aruba ClearPass Policy Manager engineering team (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.8 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Hewlett Packard Enterprise (HPE) (string)

product : Aruba ClearPass Policy Manager (string)

versions : [ »

0 : { »

status : affected (string)

version : ClearPass Policy Manager 6.12.x: 6.12.0 (string)

}

1 : { »

status : affected (string)

version : ClearPass Policy Manager 6.11.x: 6.11.6 and below (string)

}

2 : { »

status : affected (string)

version : ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below (string)

}

3 : { »

status : affected (string)

version : ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below (string)

}

]

defaultStatus : affected (string)

}

]

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : <p>A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.</p> (string)

base64 : false (boolean)

}

]

}

]

providerMetadata : { »

orgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

shortName : hpe (string)

dateUpdated : 2024-02-27T22:11:37.929Z (string)

}

cveMetadata : { »

cveId : CVE-2024-26302 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-05T15:10:37.462Z (string)

dateReserved : 2024-02-16T19:42:43.186Z (string)

assignerOrgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

datePublished : 2024-02-27T22:11:37.929Z (string)

assignerShortName : hpe (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FB4B104-2BBB-4F41-8245-97616A66C18B", "versionEndExcluding": "6.9.13", "versionStartIncluding": "6.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "84F5E56D-039C-47B0-827A-AFE34887DAD2", "versionEndExcluding": "6.10.8", "versionStartIncluding": "6.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B615E4D-D615-4AA4-B501-E9BA06A1D909", "versionEndIncluding": "6.11.6", "versionStartIncluding": "6.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-:*:*:*:*:*:*", "matchCriteriaId": "57C5BF92-A455-44E4-AE20-F9A1D790422D", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2:*:*:*:*:*:*", "matchCriteriaId": "7962FD34-6A38-461A-8942-BCA227AF8AF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3:*:*:*:*:*:*", "matchCriteriaId": "435A3CE6-AB76-4F4F-B11F-71E0C7619A9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_4:*:*:*:*:*:*", "matchCriteriaId": "48AF4969-0D31-4109-B925-E22FF9742F00", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-:*:*:*:*:*:*", "matchCriteriaId": "1DB2448F-D014-4672-90A9-3BCC91096B93", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2:*:*:*:*:*:*", "matchCriteriaId": "80F47102-7F9F-449F-91A1-76372AA7F3D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5:*:*:*:*:*:*", "matchCriteriaId": "F85708F3-CA05-472A-9B51-373D1AD14E9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_6:*:*:*:*:*:*", "matchCriteriaId": "2700588C-FBC3-4A45-A482-1168D965AAA3", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.12.0:*:*:*:*:*:*:*", "matchCriteriaId": "B9DC2CA8-B27E-48A8-BD73-A5CE9A55B6FA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.\n\n"}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de ClearPass Policy Manager podr\u00eda permitir que un atacante remoto autenticado con privilegios bajos acceda a informaci\u00f3n confidencial. Un exploit exitoso permite a un atacante recuperar informaci\u00f3n que podr\u00eda usarse para obtener acceso adicional a los servicios de red compatibles con ClearPass Policy Manager."}], "id": "CVE-2024-26302", "lastModified": "2025-03-27T15:06:24.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security-alert@hpe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-02-27T23:15:07.627", "references": [{"source": "security-alert@hpe.com", "tags": ["Broken Link"], "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3FB4B104-2BBB-4F41-8245-97616A66C18B (string)

versionEndExcluding : 6.9.13 (string)

versionStartIncluding : 6.9.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 84F5E56D-039C-47B0-827A-AFE34887DAD2 (string)

versionEndExcluding : 6.10.8 (string)

versionStartIncluding : 6.10.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 9B615E4D-D615-4AA4-B501-E9BA06A1D909 (string)

versionEndIncluding : 6.11.6 (string)

versionStartIncluding : 6.11.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-:*:*:*:*:*:* (string)

matchCriteriaId : 57C5BF92-A455-44E4-AE20-F9A1D790422D (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2:*:*:*:*:*:* (string)

matchCriteriaId : 7962FD34-6A38-461A-8942-BCA227AF8AF9 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3:*:*:*:*:*:* (string)

matchCriteriaId : 435A3CE6-AB76-4F4F-B11F-71E0C7619A9A (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_4:*:*:*:*:*:* (string)

matchCriteriaId : 48AF4969-0D31-4109-B925-E22FF9742F00 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-:*:*:*:*:*:* (string)

matchCriteriaId : 1DB2448F-D014-4672-90A9-3BCC91096B93 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2:*:*:*:*:*:* (string)

matchCriteriaId : 80F47102-7F9F-449F-91A1-76372AA7F3D4 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5:*:*:*:*:*:* (string)

matchCriteriaId : F85708F3-CA05-472A-9B51-373D1AD14E9C (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_6:*:*:*:*:*:* (string)

matchCriteriaId : 2700588C-FBC3-4A45-A482-1168D965AAA3 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.12.0:*:*:*:*:*:*:* (string)

matchCriteriaId : B9DC2CA8-B27E-48A8-BD73-A5CE9A55B6FA (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager. (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad en la interfaz de administración basada en web de ClearPass Policy Manager podría permitir que un atacante remoto autenticado con privilegios bajos acceda a información confidencial. Un exploit exitoso permite a un atacante recuperar información que podría usarse para obtener acceso adicional a los servicios de red compatibles con ClearPass Policy Manager. (string)

}

]

id : CVE-2024-26302 (string)

lastModified : 2025-03-27T15:06:24.727 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 2.5 (number)

source : security-alert@hpe.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 2.5 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-02-27T23:15:07.627 (string)

references : [ »

0 : { »

source : security-alert@hpe.com (string)

tags : [ »

0 : Broken Link (string)

]

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Broken Link (string)

]

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt (string)

}

]

sourceIdentifier : security-alert@hpe.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-276 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object