CVE-2014-2593
HighSummary
The management console in Aruba Networks ClearPass Policy Manager version 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the system and execution of malicious code by local users.
Recommendation
It is recommended to update to the latest version of ClearPass Policy Manager and restrict access to the management console to trusted users.
Other vulnerabilities in Aruba Networks ClearPass Policy Manager 6.3.0.60730
See all- CVE-2015-4649High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors.
- CVE-2015-3657High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain 'Super Admin' privileges via unspecified vectors.
- CVE-2015-3656High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.
- CVE-2015-3655High
CSRF vulnerability in Aruba Networks ClearPass Policy Manager before version 6.4.7 and 6.5.x before version 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.
- CVE-2015-3654High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, posing a serious security risk.
- CVE-2015-3653High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating system, potentially leading to denial of service or privilege escalation due to incorrect permission checking.
- CVE-2015-4650Critical
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors.
Original NVD description (English source)
The management console in Aruba Networks ClearPass Policy Manager 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command, as demonstrated by the (1) system status-rasession and (2) network ping commands.