What is CVE-2018-7067?

CVE-2018-7067 is a high-severity vulnerability in Arubanetworks Clearpass Policy Manager, classified under Improper Authentication. CVSS score: 7.2/10. Published 2018-12-07.

How severe is CVE-2018-7067?

High severity. CVSS v3 base score is 7.2 out of 10.

Auth bypass in Arubanetworks Clearpass Policy Manager

CVE-2018-7067

A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web interface is required to exploit this vulnerability. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.

Vulnerability class: Broken Authentication

EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Arubanetworks Clearpass_policy_manager
Hewlett Packard Enterprise Aruba Clearpass Policy Manager — versions All versions of ClearPass prior to 6.7.6, ClearPass 6.6.10 and earlier without hotfix applied

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

security-alert@hpe.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-7067?: CVE-2018-7067 is a high-severity vulnerability in Arubanetworks Clearpass Policy Manager, classified under Improper Authentication. CVSS score: 7.2/10. Published 2018-12-07.
How severe is CVE-2018-7067?: High severity. CVSS v3 base score is 7.2 out of 10.