CVE-2020-7113

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP packets resulting in the compromise of some of ClearPass' service accounts. Resolution: Fixed in 6.7.10, 6.8.1, 6.9.0 and higher.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-71149.8A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to c CVE-2020-71159.8The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an att CVE-2020-71167.2The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already auth CVE-2020-71177.2The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already auth CVE-2020-71194.9A vulnerability exists in the Aruba Analytics and Location Engine (ALE) web management interface 2.1.0.2 and earlier firmware that allows an CVE-2020-71205.3A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, CVE-2020-71217.5Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. Successful ex CVE-2020-71227.5Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. Successful ex CVE-2020-71237.8A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1.CVE-2020-71249.8A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-71258.8A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.CVE-2020-71265.8A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.