CVE-2024-26302

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	Aruba ClearPass Policy Manager	ClearPass Policy Manager 6.12.x: 6.12.0; ClearPass Policy Manager 6.11.x: 6.11.6 and below; ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below; ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txtBroken Link
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txtBroken Link

Timeline

Published: Feb 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-263034.9Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon CVE-2024-263049.8There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution CVE-2024-263059.8There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendin CVE-2024-263065.9iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption CVE-2024-263075.3Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the CVE-2024-263085.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: fr CVE-2024-263097.5Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. An unauthenticated attacker c CVE-2024-26314.3Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted H CVE-2024-263104.3Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could CVE-2024-263115.7Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user cou CVE-2024-263124.3Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obta CVE-2024-263135.4Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malic