CVE-2015-3655
HighSummary
CSRF vulnerability in Aruba Networks ClearPass Policy Manager before version 6.4.7 and 6.5.x before version 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.
Risk Assessment
Attackers may gain access to administrator accounts, potentially leading to unauthorized changes in system configuration and data breaches.
Recommendation
It is recommended to upgrade to the latest version of ClearPass Policy Manager to mitigate this vulnerability.
Other vulnerabilities in Aruba Networks ClearPass Policy Manager
See all- CVE-2015-4649High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors.
- CVE-2015-3657High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain 'Super Admin' privileges via unspecified vectors.
- CVE-2015-3656High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.
- CVE-2015-3654High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, posing a serious security risk.
- CVE-2015-3653High
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating system, potentially leading to denial of service or privilege escalation due to incorrect permission checking.
- CVE-2014-2593High
The management console in Aruba Networks ClearPass Policy Manager version 6.3.0.60730 allows local users to execute arbitrary commands via shell metacharacters in certain arguments of a valid command.
- CVE-2015-4650Critical
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.