CVE-2023-43510

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a non-privileged user on the underlying operating system leading to partial system compromise.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	Aruba ClearPass Policy Manager	>= ClearPass Policy Manager 6.11.x: 6.11.4 and below, <= <=6.11.4; ClearPass Policy Manager 6.10.x: 6.10.8 with ClearPass 6.10.8 Cumulative Hotfix Patch 5 and below; ClearPass Policy Manager 6.9.x: 6.9.13 with ClearPass 6.9.13 Cumulative Hotfix Patch 3 and below

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txtVendor Advisory

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-435117.5Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header CVE-2023-435127.5Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the CVE-2023-435137.8Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values CVE-2023-435147.8Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.CVE-2023-435157.8Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.CVE-2023-435167.8Memory corruption when malformed message payload is received from firmware.CVE-2023-435177.8Memory corruption in Automotive Multimedia due to improper access control in HAB.CVE-2023-435189.8Memory corruption in video while parsing invalid mp2 clip.CVE-2023-435199.8Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.CVE-2023-43528.8Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2023-435209.8Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.CVE-2023-435217.8Memory corruption when multiple listeners are being registered with the same file descriptor.