CVE-2024-53672

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)HPE Aruba Networking ClearPass Policy Manager>= 6.12.0, <= 6.12.2; >= 6.11.0, <= 6.11.9

References

Timeline

Published
Dec 3, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-536739.8A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.CVE-2024-536747.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainCVE-2024-536757.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainCVE-2024-536769.8A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.CVE-2024-536779.8File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumsCVE-2024-536788.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form dataCVE-2024-536795.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A CVE-2024-53686.1A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown functionCVE-2024-536805.5In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()CVE-2024-536815.5In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats CVE-2024-536825.5In the Linux kernel, the following vulnerability has been resolved: regulator: axp20x: AXP717: set ramp_delay AXP717 datasheet says that rCVE-2024-536834.4A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use