CVE-2024-51773: Authenticated Stored Cross-Site Scripting (XSS) in HPE Aruba Networking ClearPass Policy Manager Web-based Management Interface
First published: Tue Dec 03 2024(Updated: )
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session.
Credit: security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Aruba ClearPass Policy Manager |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-51773?
CVE-2024-51773 has a medium severity level as it allows authenticated attackers to execute stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-51773?
To fix CVE-2024-51773, it is recommended to apply the latest security patches provided by HPE for the Aruba ClearPass Policy Manager.
Who is impacted by CVE-2024-51773?
The vulnerability affects users of the HPE Aruba Networking ClearPass Policy Manager that have web-based access enabled.
What is a stored cross-site scripting attack in the context of CVE-2024-51773?
In the context of CVE-2024-51773, a stored cross-site scripting attack allows an attacker to inject malicious scripts that are executed when other users access affected pages.
Can CVE-2024-51773 be exploited remotely?
Yes, CVE-2024-51773 can be exploited remotely by authenticated attackers without requiring physical access.
- agent/references
- agent/description
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/hpe
- canonical/aruba clearpass policy manager