CVE-2024-51773: arubanetworks clearpass_policy_manager Cross-site Scripting

Vulnerability summary

CVE-2024-51773 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in arubanetworks clearpass_policy_manager. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.7% of scored vulnerabilities.

Timeline

1. 03-12-2024
   PublishedVulnerability first disclosed.
2. 03-12-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.