Vulnerability · Published Sep 20, 2022 · Assigned by hpe

CVE-2022-37884

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Aruba ClearPass Policy Manager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific operations which result in a Denial-of-Service condition. A successful exploitation of this vulnerability results in the unavailability of the guest interface in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Aruba ClearPass Policy Manager	6.10.x: 6.10.6 and below6.9.x: 6.9.11 and below

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt x_refsource_MISC