Medium severity · published Oct 24, 2023
CVE-2023-43509
Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications
5.8
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Aruba ClearPass Policy Manager · Hewlett Packard Enterprise (HPE)
ClearPass Policy Manager 6.11.x: 6.11.4 and below through <=6.11.4; ClearPass Policy Manager 6.10.x: 6.10.8 with ClearPass 6.10.8 Cumulative Hotfix Patch 5 and below; ClearPass Policy Manager 6.9.x: 6.9.13 with ClearPass 6.9.13 Cumulative Hotfix Patch 3 and below · source: vendor
CP
Clearpass Policy Manager · Arubanetworks
before 6.9.13; 6.10.0 before 6.10.8; 6.11.0 through 6.11.4; 6.9.13; 6.9.13; 6.9.13; +3 more · source: NVD
AC
Aruba Clear Pass Policy Manager · Hpe
6.11x through 6.11.4; 6.10x before 6.10.8; 6.9x before 6.9.13 · source: CISA
Affected product
AC
Aruba ClearPass Policy Manager
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43509
Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt
More from Aruba ClearPass Policy Manager
8.8
CVE-2024-26298
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host
8.8
CVE-2024-26297
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host
8.8
CVE-2024-26296
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host
8.8
CVE-2024-26295
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host
8.8
CVE-2024-26294
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host