CVE-2018-7060

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise	Aruba ClearPass	6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txtVendor Advisory

Timeline

Published: Aug 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-70638.1In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which hav CVE-2018-70646.1A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use thi CVE-2018-70657.2An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass a CVE-2018-70669.0An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature perm CVE-2018-70677.2A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all version CVE-2018-70686.1HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issu CVE-2018-70697.5HPE has identified a remote unauthenticated access to files vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6 CVE-2018-70705.3HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. Th CVE-2018-70714.3HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior CVE-2018-70729.8A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.CVE-2018-70735.5A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.CVE-2018-70749.8A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07. The vulnerability was res