Vulnerability in Arubanetworks Clearpass Policy Manager
CVE-2020-7116
The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.033 (88.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.033 · newest: 0.033 · change: 0.000
Affected products
- Arubanetworks Clearpass Policy Manager
- Clearpass Policy Manager — versions ClearPass 6.9.x prior to 6.9.1 ClearPass 6.8.x prior to 6.8.5-HF ClearPass 6.7.x prior to 6.7.13-HF
References
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7116?
- CVE-2020-7116 is a high-severity vulnerability in Arubanetworks Clearpass Policy Manager. CVSS score: 7.2/10. Published 2020-06-03.
- How severe is CVE-2020-7116?
- High severity. CVSS v3 base score is 7.2 out of 10.