CVE-2024-26299

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	Aruba ClearPass Policy Manager	ClearPass Policy Manager 6.12.x: 6.12.0; ClearPass Policy Manager 6.11.x: 6.11.6 and below; ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below; ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txtBroken Link
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txtBroken Link

Timeline

Published: Feb 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-26306.5Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafte CVE-2024-263004.8A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-si CVE-2024-263016.5A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privi CVE-2024-263024.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privi CVE-2024-263034.9Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon CVE-2024-263049.8There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution CVE-2024-263059.8There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendin CVE-2024-263065.9iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption CVE-2024-263075.3Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the CVE-2024-263085.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: fr CVE-2024-263097.5Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. An unauthenticated attacker c CVE-2024-26314.3Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted H