Vulnerability Description
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Clearpass Policy Manager | < 6.6.10 |
Related Weaknesses (CWE)
References
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txtVendor Advisory
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txtVendor Advisory
FAQ
What is CVE-2018-7063?
CVE-2018-7063 is a vulnerability with a CVSS score of 8.1 (HIGH). In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write oper...
How severe is CVE-2018-7063?
CVE-2018-7063 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-7063?
Check the references section above for vendor advisories and patch information. Affected products include: Arubanetworks Clearpass Policy Manager.