CVE-2017-5826

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise	Aruba ClearPass Policy Manager	6.6.x

References

http://www.arubanetworks.com/assets/alert/HPESBHF03730.txtThird Party Advisory
http://www.securityfocus.com/bid/98722Third Party Advisory, VDB Entry
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03730en_usVendor Advisory
http://www.arubanetworks.com/assets/alert/HPESBHF03730.txtThird Party Advisory
http://www.securityfocus.com/bid/98722Third Party Advisory, VDB Entry
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03730en_usVendor Advisory

Timeline

Published: Feb 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-58275.4A reflected cross site scripting vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.CVE-2017-58288.1An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.CVE-2017-58297.8An access restriction bypass vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.CVE-2017-58309.8Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery sc CVE-2017-58315.9Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote CVE-2017-58325.4Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or CVE-2017-58336.1Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows rem CVE-2017-58345.5The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a CVE-2017-58357.5libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.CVE-2017-58367.5The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer n CVE-2017-58375.5The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attac CVE-2017-58387.5The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial