CVE-2018-7060 Cross-site request forgery in Aruba ClearPass
An attacker can trick authenticated users into performing unauthorized actions on the Aruba ClearPass web administrative interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-7060?
CVE-2018-7060 is a high-severity vulnerability in Hewlett Packard Enterprise Aruba ClearPass, published on 6 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.
Weakness: CWE-352
Which versions are affected by CVE-2018-7060?
It affects 1 product.
Products include Arubanetworks Clearpass.
How do I fix CVE-2018-7060?
No fix has been published for CVE-2018-7060 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7060 being exploited?
There is no known exploitation of CVE-2018-7060 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise Aruba ClearPass
Sources
Also known as GHSA-34pj-48rw-2hgw.