CSRF in Arubanetworks Clearpass
CVE-2018-7060
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (37.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Arubanetworks Clearpass
- Hewlett Packard Enterprise Aruba Clearpass — versions 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1
Weakness classification (CWE)
References
- security-alert@hpe.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-7060?
- CVE-2018-7060 is a high-severity vulnerability in Arubanetworks Clearpass, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2018-08-06.
- How severe is CVE-2018-7060?
- High severity. CVSS v3 base score is 8.8 out of 10.