CVE-2018-7063: arubanetworks clearpass_policy_manager
Vulnerability summary
CVE-2018-7063 is a high (CVSS 8.1) vulnerability in arubanetworks clearpass_policy_manager. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.4% of scored vulnerabilities.
Timeline
- 07-12-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.85%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.85% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Arubanetworks1 product
- clearpass_policy_manager< 6.6.10 | ≥ 6.7.0, < 6.7.3
Hewlett packard enterprise1 product
- aruba clearpass policy managerClearPass 6.7.x prior to 6.7.6, ClearPass 6.6.10 and earlier without hotfix applied
2 vendors · 2 products