Aruba Networks ClearPass Policy Manager CVE-2014-2593 Command Injection Vulnerability

Bugtraq ID:	69391
Class:	Input Validation Error
CVE:	CVE-2014-2593
Remote:	Yes
Local:	No
Published:	Aug 25 2014 12:00AM
Updated:	Aug 25 2014 12:00AM
Credit:	Francisco Ribeiro
Vulnerable:	Arubanetworks ClearPass Policy Manager 6.3.0.60730
Not Vulnerable:

Aruba Networks ClearPass Policy Manager CVE-2014-2593 Command Injection Vulnerability

Aruba Networks ClearPass Policy Manager is prone to a remote command-injection vulnerability because it fails to properly sanitize user-supplied input.

Successfully exploiting this issue may allow an attacker to execute arbitrary commands in the context of the currently logged-in user. Successful exploits could compromise the application and possibly the underlying system.

ClearPass Policy Manager 6.3.0.60730 is vulnerable; other versions may also be affected.

Aruba Networks ClearPass Policy Manager CVE-2014-2593 Command Injection Vulnerability

Attackers can exploit this issue using browser or readily available tools.

Aruba Networks ClearPass Policy Manager CVE-2014-2593 Command Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Aruba Networks ClearPass Policy Manager CVE-2014-2593 Command Injection Vulnerability

References:

• Aruba Networks Homepage (Aruba Networks)
  
• ClearPass Policy Manager Product page (Aruba Networks)
  
• Vulnerability title: Command Injection In Aruba ClearPass Policy Manager (Portcullis Computer Security)