CVE-2018-7065: SQL Injection
An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass are affected by multiple authenticated SQL injection vulnerabilities. In each case, an authenticated administrative user of any type could exploit this vulnerability to gain access to "appadmin" credentials, leading to complete cluster compromise. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7065?
CVE-2018-7065 is a high severity authenticated SQL injection vulnerability that can lead to privilege escalation.
Which versions of Aruba ClearPass are affected by CVE-2018-7065?
All versions of Aruba ClearPass Policy Manager up to 6.6.10 and between 6.7.0 and 6.7.6 are affected by CVE-2018-7065.
How do I fix CVE-2018-7065?
To fix CVE-2018-7065, users should upgrade to Aruba ClearPass Policy Manager version 6.7.6 or later.
Who can exploit the CVE-2018-7065 vulnerability?
An authenticated administrative user of any type can exploit the CVE-2018-7065 vulnerability.
What risks are associated with CVE-2018-7065?
Exploiting CVE-2018-7065 can lead to unauthorized privilege escalation within the affected Aruba ClearPass environment.