CVE-2013-2269 — MEDIUM (5.0)

Vulnerability Description

The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in conjunction with information from a "default holding page" to discover the link that is used for sponsor approval of the guest request, then performing a direct request to that link.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Arubanetworks	Clearpass	5.0.1
Arubanetworks	Clearpass Guest	3.0

Related Weaknesses (CWE)

CWE-264

References

http://secunia.com/advisories/53358Vendor Advisory
http://www.arubanetworks.com/support/alerts/aid-050813.ascVendor Advisory
http://www.securityfocus.com/bid/59805
http://secunia.com/advisories/53358Vendor Advisory
http://www.arubanetworks.com/support/alerts/aid-050813.ascVendor Advisory
http://www.securityfocus.com/bid/59805

FAQ

What is CVE-2013-2269?

CVE-2013-2269 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrict...

How severe is CVE-2013-2269?

CVE-2013-2269 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-2269?

Check the references section above for vendor advisories and patch information. Affected products include: Arubanetworks Clearpass, Arubanetworks Clearpass Guest.