CVE-2023-43507

HIGH

ClearPass Policy Manager - SQL Injection

Title source: llm

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.

References (1)

Core 1

Core References

Vendor Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt

Scores

CVSS v3 7.2

EPSS 0.0041

EPSS Percentile 61.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-89

Status published

Products (3)

arubanetworks/clearpass_policy_manager 6.9.13 (3 CPE variants)

arubanetworks/clearpass_policy_manager 6.10.8 (3 CPE variants)

arubanetworks/clearpass_policy_manager < 6.9.13

Published Oct 25, 2023

Tracked Since Feb 18, 2026