Aruba Networks ClearPass Policy Manager CVE-2015-3655 Cross Site Request Forgery Vulnerability
BID:100594
CVE-2015-3655 |Info
Aruba Networks ClearPass Policy Manager CVE-2015-3655 Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 100594 |
| Class: | Design Error |
| CVE: |
CVE-2015-3655 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2017 12:00AM |
| Updated: | Aug 29 2017 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Arubanetworks ClearPass Policy Manager 6.5.1 Arubanetworks ClearPass Policy Manager 6.5 Arubanetworks ClearPass Policy Manager 6.4.6 Arubanetworks ClearPass Policy Manager 6.4.5 Arubanetworks ClearPass Policy Manager 6.4.2 Arubanetworks ClearPass Policy Manager 6.4.1 Arubanetworks ClearPass Policy Manager 6.4 Arubanetworks ClearPass Policy Manager 6.3.6 Arubanetworks ClearPass Policy Manager 6.3.5 Arubanetworks ClearPass Policy Manager 6.2.6 Arubanetworks ClearPass Policy Manager 6.2 Arubanetworks ClearPass Policy Manager 6.1 Arubanetworks ClearPass Policy Manager 6.4.4 Arubanetworks ClearPass Policy Manager 6.4.3 Arubanetworks ClearPass Policy Manager 6.0 |
| Not Vulnerable: |
Arubanetworks ClearPass Policy Manager 6.5.2 Arubanetworks ClearPass Policy Manager 6.4.7 |
Discussion
Aruba Networks ClearPass Policy Manager CVE-2015-3655 Cross Site Request Forgery Vulnerability
Aruba Networks ClearPass Policy Manager is prone to a cross-site request-forgery vulnerability because it fails to properly validate requests.
Exploiting this issue allows a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Versions prior to ClearPass Policy Manager 6.4.7 and 6.5.x prior to 6.5.2 are vulnerable.
Aruba Networks ClearPass Policy Manager is prone to a cross-site request-forgery vulnerability because it fails to properly validate requests.
Exploiting this issue allows a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Versions prior to ClearPass Policy Manager 6.4.7 and 6.5.x prior to 6.5.2 are vulnerable.
Exploit / POC
Aruba Networks ClearPass Policy Manager CVE-2015-3655 Cross Site Request Forgery Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.