CVE-2024-41915

HIGH

ClearPass Policy Manager 6.11.0-6.11.8 - Authenticated SQL Injection

Title source: llm

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.

References (1)

Core 1

Core References

Vendor Advisory

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04675en_us&docLocale=en_US

Scores

CVSS v3 7.2

EPSS 0.0077

EPSS Percentile 73.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

arubanetworks/clearpass_policy_manager 6.11.0 - 6.11.9

Published Jul 30, 2024

Tracked Since Feb 18, 2026