CVE-2022-43539

A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position to potentially obtain sensitive information. A successful exploit could allow an attacker to retrieve information that allows for unauthorized actions as a privileged user on the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x: 6.9.12 and below.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 4.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt	Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::
	cpe:2.3:a:arubanetworks:clearpass_policy_manager::::::::

History

10 Apr 2025, 16:15

Type	Values Removed	Values Added
CWE		CWE-200

Information

Published : 2023-01-05 07:15

Updated : 2025-04-10 16:15

NVD link : CVE-2022-43539

Mitre link : CVE-2022-43539

CVE.ORG link : CVE-2022-43539

JSON object : View

Products Affected

arubanetworks

clearpass_policy_manager

CWE

NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2022-43539", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2023-01-05T07:15:13.987", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}, {"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": " A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position to potentially obtain sensitive information. A successful exploit could allow an attacker to retrieve information that allows for unauthorized actions as a privileged user on the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x: 6.9.12 and below.\n\n"}, {"lang": "es", "value": "Existe una vulnerabilidad en las comunicaciones del cl\u00faster de ClearPass Policy Manager que permite que un atacante en una posici\u00f3n privilegiada de la red obtenga informaci\u00f3n confidencial. Un exploit exitoso podr\u00eda permitir a un atacante recuperar informaci\u00f3n que permita acciones no autorizadas como usuario privilegiado en el cl\u00faster de ClearPass Policy Manager en las versiones de Aruba ClearPass Policy Manager: ClearPass Policy Manager 6.10.x: 6.10.7 y anteriores y ClearPass Policy Manager 6.9.x: 6.9.12 y anteriores."}], "lastModified": "2025-04-10T16:15:25.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57F180BC-B95D-4B3A-9C1C-38611C4B80C6", "versionEndExcluding": "6.9.12", "versionStartIncluding": "6.9.0"}, {"criteria": "cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327E889C-2867-4E82-AB1A-2D47735D5EF5", "versionEndExcluding": "6.10.7", "versionStartIncluding": "6.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}