High severity · published Jul 30, 2024
CVE-2024-41915
Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
ClearPass Policy Manager (CPPM) · Hewlett Packard Enterprise (HPE)
ClearPass Policy Manager 6.12.1 and below through <=6.12.1; ClearPass Policy Manager 6.11.8 and below through <=6.11.8 · source: vendor
CP
Clearpass Policy Manager · Arubanetworks
6.11.0 before 6.11.9; 6.12.0 before 6.12.2 · source: NVD, CISA
Affected product
CP
ClearPass Policy Manager (CPPM)
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41915
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41915
Vendor Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US
More from ClearPass Policy Manager (CPPM)
9.9
CVE-2026-79798
Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface
9.8
CVE-2026-79805
Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager
9.8
CVE-2026-79801
Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent
9.8
CVE-2026-79796
Authentication Bypass Vulnerabilities in ClearPass Policy Manager
9.8
CVE-2026-76754
Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager