CVE-2022-37881: Command Injection
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-37881?
CVE-2022-37881 refers to a vulnerability in the ClearPass Policy Manager web-based management interface that allows remote authenticated users to run arbitrary commands on the underlying host.
How severe is CVE-2022-37881?
CVE-2022-37881 has a severity level of 7.2 (high).
Which software versions are affected by CVE-2022-37881?
ClearPass Policy Manager versions between 6.9.0 and 6.9.12, as well as versions between 6.10.0 and 6.10.7, are affected by CVE-2022-37881.
What can an attacker do with CVE-2022-37881?
If successfully exploited, an attacker can execute arbitrary commands as root on the underlying operating system, leading to complete control over the system.
How can I fix CVE-2022-37881?
To fix CVE-2022-37881, it is recommended to upgrade ClearPass Policy Manager to a version that is not affected by the vulnerability. Arubanetworks Clearpass Policy Manager version 6.9.13 or higher and version 6.10.8 or higher are secure.