CVE-2018-7067: arubanetworks clearpass_policy_manager Improper Authentication
Vulnerability summary
CVE-2018-7067 is a high (CVSS 7.2) Improper Authentication vulnerability in arubanetworks clearpass_policy_manager. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 70.9% of scored vulnerabilities.
Timeline
- 07-12-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web interface is required to exploit this vulnerability. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.34%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.34% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Arubanetworks1 product
- clearpass_policy_manager< 6.6.10 | ≥ 6.7.0, < 6.7.6
Hewlett packard enterprise1 product
- aruba clearpass policy managerAll versions of ClearPass prior to 6.7.6, ClearPass 6.6.10 and earlier without hotfix applied
2 vendors · 2 products