CVE-2022-37884 Denial of service in Aruba ClearPass Policy Manager

High 7.5 Published 20 Sep 2022 Updated 28 May 2025

Unauthenticated attackers can cause a Denial-of-Service condition in the Aruba ClearPass Policy Manager guest interface by sending specific operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-37884?

CVE-2022-37884 is a high-severity denial of service vulnerability in Arubanetworks Clearpass Policy Manager, published on 20 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific operations which result in a Denial-of-Service condition. A successful exploitation of this vulnerability results in the unavailability of the guest interface in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.

Weakness: CWE-400

Which versions are affected by CVE-2022-37884?

It affects 1 product.

Products include Arubanetworks Clearpass Policy Manager.

How do I fix CVE-2022-37884?

No fix has been published for CVE-2022-37884 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-37884 being exploited?

There is no known exploitation of CVE-2022-37884 in the wild and no public exploit code.

All Arubanetworks Clearpass Policy Manager vulnerabilities

Sources

Also known as GHSA-jp9x-px2h-j57p.