CVE-2018-7079

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privilege users to view, modify, or delete guest users. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Dec 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-70807.5A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit CVE-2018-70819.8A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability t CVE-2018-70827.2A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary command CVE-2018-70837.5If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at t CVE-2018-70849.8A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute CVE-2018-70906.1HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to e CVE-2018-70916.1HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-CVE-2018-70927.5A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerabil CVE-2018-70938.6A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager CVE-2018-70945.5A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-5.0.0.0-22913(GA). The vulnerability may be exploited loc CVE-2018-70959.8A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited rem CVE-2018-70969.8A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited rem