CVE-2018-7079

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privilege users to view, modify, or delete guest users. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
Hewlett Packard EnterpriseAruba ClearPass Policy ManagerClearPass 6.7.x prior to 6.7.6, ClearPass 6.6.10 and earlier without hotfix applied

References

Timeline

Published
Dec 7, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-70807.5A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit CVE-2018-70819.8A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability tCVE-2018-70827.2A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commandCVE-2018-70837.5If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at tCVE-2018-70849.8A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute CVE-2018-70906.1HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to eCVE-2018-70916.1HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-CVE-2018-70927.5A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerabilCVE-2018-70938.6A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis ManagerCVE-2018-70945.5A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-5.0.0.0-22913(GA). The vulnerability may be exploited locCVE-2018-70959.8A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remCVE-2018-70969.8A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited rem
CVE-2018-7079: High severity, CVSS 7.2 | Vulnix