CVE-2018-7058 Auth bypass in Aruba ClearPass
An authentication bypass in Aruba ClearPass web interfaces allows attackers to gain administrator privileges on the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7058?
CVE-2018-7058 is a critical authentication bypass vulnerability in Hewlett Packard Enterprise Aruba ClearPass, published on 6 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest captive portal, and API. Customers who do not expose ClearPass web interfaces to untrusted users are impacted to a lesser extent.
Weakness: CWE-287
Which versions are affected by CVE-2018-7058?
It affects 1 product.
Products include Hp Aruba Clearpass Policy Manager.
How do I fix CVE-2018-7058?
No fix has been published for CVE-2018-7058 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-7058 being exploited?
There is no known exploitation of CVE-2018-7058 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise Aruba ClearPass
Sources
Also known as GHSA-269j-j2cg-h6qp.