CVE-2018-7063: XEE
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7063?
CVE-2018-7063 is classified as a medium severity vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2018-7063?
To fix CVE-2018-7063, ensure that all API admin accounts are properly disabled and consider upgrading to the latest version of Aruba ClearPass.
What are the affected versions of Aruba ClearPass for CVE-2018-7063?
CVE-2018-7063 affects Aruba ClearPass versions up to 6.6.10 and from 6.7.0 to 6.7.3.
What type of attacks can CVE-2018-7063 facilitate?
CVE-2018-7063 can facilitate unauthorized access and modifications through the XML API by disabled API admins.
Is there a workaround for CVE-2018-7063?
There is no official workaround for CVE-2018-7063; the best course of action is to apply the necessary updates.