{"containers": {"cna": {"affected": [{"product": "Aruba ClearPass Policy Manager", "vendor": "Hewlett Packard Enterprise", "versions": [{"status": "affected", "version": "ClearPass 6.7.x prior to 6.7.5, ClearPass 6.6.10 and earlier without hotfix applied"}]}], "datePublic": "2018-12-07T00:00:00", "descriptions": [{"lang": "en", "value": "An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings. Resolution: Fixed in 6.7.5 and 6.6.10-hotfix."}], "problemTypes": [{"descriptions": [{"description": "remote command execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-07T20:57:01", "orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-alert@hpe.com", "ID": "CVE-2018-7066", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Aruba ClearPass Policy Manager", "version": {"version_data": [{"version_value": "ClearPass 6.7.x prior to 6.7.5, ClearPass 6.6.10 and earlier without hotfix applied"}]}}]}, "vendor_name": "Hewlett Packard Enterprise"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings. Resolution: Fixed in 6.7.5 and 6.6.10-hotfix."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "remote command execution"}]}]}, "references": {"reference_data": [{"name": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt", "refsource": "CONFIRM", "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt"}]}}}}, "cveMetadata": {"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "assignerShortName": "hpe", "cveId": "CVE-2018-7066", "datePublished": "2018-12-07T21:00:00", "dateReserved": "2018-02-15T00:00:00", "dateUpdated": "2018-12-07T20:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "534E3208-12B0-42D9-86A6-B2872C94DE7F", "versionEndExcluding": "6.6.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE24FD1E-9BA2-4044-B3B3-01982335042B", "versionEndExcluding": "6.7.5", "versionStartIncluding": "6.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings. Resolution: Fixed in 6.7.5 and 6.6.10-hotfix."}, {"lang": "es", "value": "Existe una ejecuci\u00f3n remota de comandos sin autenticar en Aruba ClearPass Policy Manager en dispositivos enlazados. La caracter\u00edstica ClearPass OnConnect permite que los administradores conecten otros dispositivos de red en ClearPass para recopilar informaci\u00f3n mejorada sobre los endpoints conectados. Un defecto en la API podr\u00eda permitir que un atacante remoto ejecute comandos arbitrarios en uno de los dispositivos enlazados. La vulnerabilidad solo es aplicable si las credenciales para los dispositivos se han proporcionado a ClearPass en Configuration ->Network ->Devices ->CLI Settings. Soluci\u00f3n: solucionado en 6.7.5 y 6.6.10-hotfix."}], "id": "CVE-2018-7066", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-07T21:29:01.233", "references": [{"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}