CVE-2024-51773: Authenticated Stored Cross-Site Scripting (XSS) in HPE Aruba Networking ClearPass Policy Manager Web-based Management Interface
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51773?
CVE-2024-51773 has a medium severity level as it allows authenticated attackers to execute stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-51773?
To fix CVE-2024-51773, it is recommended to apply the latest security patches provided by HPE for the Aruba ClearPass Policy Manager.
Who is impacted by CVE-2024-51773?
The vulnerability affects users of the HPE Aruba Networking ClearPass Policy Manager that have web-based access enabled.
What is a stored cross-site scripting attack in the context of CVE-2024-51773?
In the context of CVE-2024-51773, a stored cross-site scripting attack allows an attacker to inject malicious scripts that are executed when other users access affected pages.
Can CVE-2024-51773 be exploited remotely?
Yes, CVE-2024-51773 can be exploited remotely by authenticated attackers without requiring physical access.