CVE-2022-37879

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-378807.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2022-378817.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2022-378827.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2022-378837.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2022-378847.5A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific oper CVE-2022-378859.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2022-378869.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2022-378879.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2022-378889.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2022-378899.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2022-37899.8A vulnerability has been found in Tim Campus Confession Wall and classified as critical. Affected by this vulnerability is an unknown functi CVE-2022-378909.8Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploit