CVE-2022-23693
Last modified
CVE-2022-23693 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. EPSS estimates a 0.86% chance of exploitation in the next 30 days.
Description
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Clearpass Policy Manager | >= 6.9.0, < 6.9.12 |
| Arubanetworks | Clearpass Policy Manager | >= 6.10.0, < 6.10.7 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23693?
How severe is CVE-2022-23693?
How do I fix CVE-2022-23693?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23688Multiple vulnerabilities exist in the processing of packet d…4.3
- CVE-2022-23689Multiple vulnerabilities exist in the processing of packet d…4.3
- CVE-2022-2369The YaySMTP WordPress plugin before 2.2.1 does not have capa…4.3
- CVE-2022-23690A vulnerability in the web-based management interface of AOS…5.3
- CVE-2022-23691A vulnerability exists in certain AOS-CX switch models which…6.8
- CVE-2022-23692Vulnerabilities in the web-based management interface of Cle…8.8
- CVE-2022-23694Vulnerabilities in the web-based management interface of Cle…8.8
- CVE-2022-23695Vulnerabilities in the web-based management interface of Cle…8.8
- CVE-2022-23696Vulnerabilities in the web-based management interface of Cle…8.8
- CVE-2022-23697A remote cross-site scripting (xss) vulnerability was discov…6.1
- CVE-2022-23698A remote unauthenticated disclosure of information vulnerabi…7.5
- CVE-2022-23699A local authentication restriction bypass vulnerability was …7.8
Are you affected by CVE-2022-23693?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST