CP
Product
Clearpass Policy Manager
On CISA KEVExploited in the wildRansomware-linked
136
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 17High 71Medium 40Low 0
Watch
Add Clearpass Policy Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-5638 RansomwareIn wildKEV | 9.8 | Mar 11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload… Affected: before 6.6.5 |
| CVE-2022-23660 | 10.0 | May 16 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2022-23658 | 10.0 | May 16 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2022-23657 | 10.0 | May 16 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2023-25589 | 9.8 | Mar 22 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform Affected: 6.9.0 through 6.9.13; 6.10.0 through 6.10.8; 6.11.0; 6.11.1 |
| CVE-2021-40997 | 9.8 | Oct 15 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy… Affected: 6.8.0 before 6.8.9; 6.9.0 before 6.9.7; 6.10.0 before 6.10.2; 6.8.9; 6.9.7 |
| CVE-2021-40996 | 9.8 | Oct 15 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy… Affected: 6.8.0 before 6.8.9; 6.9.0 before 6.9.7; 6.10.0 before 6.10.2; 6.8.9; 6.9.7 |
| CVE-2021-37736 | 9.8 | Oct 15 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy… Affected: 6.8.0 before 6.8.9; 6.9.0 before 6.9.7; 6.10.0 before 6.10.2 |
| CVE-2020-7115 | 9.8 | Jun 3 | The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass Affected: 6.7.0 through 6.7.13; 6.8.0 before 6.8.6; 6.9.0 before 6.9.1 |
| CVE-2015-4650 | 9.8 | Oct 16 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via… Affected: through 6.4.6; 6.5.0; 6.5.1 |
| CVE-2022-23666 | 9.1 | May 16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x… Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2022-23665 | 9.1 | May 16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x… Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2022-23664 | 9.1 | May 16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x… Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2022-23663 | 9.1 | May 16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x… Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2022-23662 | 9.1 | May 16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x… Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2022-23661 | 9.1 | May 16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x… Affected: before 6.8.9; 6.9.0 before 6.9.10; 6.10.0 before 6.10.5; 6.8.9; 6.8.9; 6.8.9 |
| CVE-2018-7066 | 9.0 | Dec 7 | An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices Affected: before 6.6.10; 6.7.0 before 6.7.5 |
| CVE-2025-25039 | 8.8 | Feb 4 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the… Affected: 6.11.0 before 6.11.10; 6.12.0 before 6.12.4 |
| CVE-2024-51771 | 8.8 | Dec 3 | A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code… Affected: 6.11.0 before 6.11.10; 6.12.0 before 6.12.3 |
| CVE-2024-41915 | 8.8 | Jul 30 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.11.0 before 6.11.9; 6.12.0 before 6.12.2 |
| CVE-2024-26298 | 8.8 | Feb 27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host Affected: 6.9.0 before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.6; 6.9.13; 6.9.13; 6.9.13; +6 more |
| CVE-2024-26297 | 8.8 | Feb 27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host Affected: 6.9.0 before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.6; 6.9.13; 6.9.13; 6.9.13; +6 more |
| CVE-2024-26296 | 8.8 | Feb 27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host Affected: 6.9.0 before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.6; 6.9.13; 6.9.13; 6.9.13; +6 more |
| CVE-2024-26295 | 8.8 | Feb 27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host Affected: 6.9.0 before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.6; 6.9.13; 6.9.13; 6.9.13; +6 more |
| CVE-2024-26294 | 8.8 | Feb 27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host Affected: 6.9.0 before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.6; 6.9.13; 6.9.13; 6.9.13; +6 more |
| CVE-2023-43507 | 8.8 | Oct 25 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.4; 6.9.13; 6.9.13; 6.9.13; +3 more |
| CVE-2023-25594 | 8.8 | Mar 22 | A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the… Affected: 6.9.0 through 6.9.13; 6.10.0 through 6.10.8; 6.11.0; 6.11.1 |
| CVE-2022-43536 | 8.8 | Jan 5 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-43531 | 8.8 | Jan 5 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-43530 | 8.8 | Jan 5 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-23696 | 8.8 | Sep 20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-23695 | 8.8 | Sep 20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-23694 | 8.8 | Sep 20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-23693 | 8.8 | Sep 20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-23692 | 8.8 | Sep 20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the… Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-23685 | 8.8 | Sep 20 | A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSRF) protection Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-23669 | 8.8 | May 17 | A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below Affected: through 6.7.14; 6.8.0 before 6.8.9; 6.9.0 through 6.9.9; 6.10.0 through 6.10.4; 6.8.9; 6.8.9; +1 more |
| CVE-2021-37737 | 8.8 | Oct 15 | A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager… Affected: 6.8.0 before 6.8.9; 6.9.0 before 6.9.7; 6.10.0 before 6.10.2 |
| CVE-2021-34609 | 8.8 | Jul 8 | A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9 Affected: 6.6.0 through 6.6.10; 6.7.0 through 6.7.14; 6.8.0 before 6.8.9; 6.9.0 before 6.9.6 |
| CVE-2025-23060 | 8.1 | Feb 4 | A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information Affected: 6.11.0 before 6.11.10; 6.12.0 before 6.12.4 |
| CVE-2025-23058 | 8.1 | Feb 4 | A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to… Affected: 6.11.0 before 6.11.10; 6.12.0 before 6.12.4 |
| CVE-2021-40993 | 8.1 | Oct 15 | A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager… Affected: 6.8.0 before 6.8.9; 6.9.0 before 6.9.7; 6.10.0 before 6.10.2; 6.8.9; 6.9.7 |
| CVE-2018-7063 | 8.1 | Dec 7 | In Aruba ClearPass, disabled API admins can still perform read/write operations Affected: before 6.6.10; 6.7.0 before 6.7.3 |
| CVE-2024-51772 | 8.0 | Dec 3 | An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying… Affected: 6.11.0 before 6.11.10; 6.12.0 before 6.12.3 |
| CVE-2023-43506 | 7.8 | Oct 25 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role Affected: before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.4; 6.9.13; 6.9.13; 6.9.13; +3 more |
| CVE-2023-25590 | 7.8 | Mar 22 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role Affected: 6.9.0 through 6.9.13; 6.10.0 through 6.10.8; 6.11.0; 6.11.1 |
| CVE-2022-43535 | 7.8 | Jan 5 | A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-43534 | 7.8 | Jan 5 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-43533 | 7.8 | Jan 5 | A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |
| CVE-2022-37877 | 7.8 | Sep 20 | A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges Affected: 6.9.0 before 6.9.12; 6.10.0 before 6.10.7 |