CVE-2022-37879: Command Injection
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-37879?
CVE-2022-37879 is a vulnerability in the ClearPass Policy Manager web-based management interface that allows remote authenticated users to run arbitrary commands on the underlying host.
What is the severity of CVE-2022-37879?
CVE-2022-37879 has a severity rating of 7.2, which is considered high.
Which versions of Arubanetworks Clearpass Policy Manager are affected by CVE-2022-37879?
Arubanetworks Clearpass Policy Manager versions between 6.9.0 and 6.9.12, and versions between 6.10.0 and 6.10.7 are affected by CVE-2022-37879.
How can an attacker exploit CVE-2022-37879?
An attacker can exploit CVE-2022-37879 by executing arbitrary commands as root on the underlying operating system through a successful exploit.
Is there a fix for CVE-2022-37879?
Yes, applying the necessary patches and updates provided by Arubanetworks is recommended to fix CVE-2022-37879.