← Vulnerability feed

Vulnerability record · CVE-2018-7059 · published 6 August 2018

CVE-2018-7059: Hp aruba clearpass policy manager improper input validation vulnerability

Hp · Aruba Clearpass Policy Manager

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when authenticated as a user with "mon" permission.

8.8 CVSS 3.0 High EPSS 1.1% · top 35.4% CWE-20 · Improper input validation
8.8CVSS 3.0 base score, v2 4.0
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when authenticated as a user with "mon" permission.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt Vendor Advisory

Track CVE-2018-7059 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-7058Hp aruba clearpass policy manager improper authentication vulnerabilityAruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerabi…EPSS 3.9%9.8CVE-2017-5824Hp aruba clearpass policy manager vulnerabilityAn unauthenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.EPSS 19%8.8CVE-2017-5825Hp aruba clearpass policy manager vulnerabilityA privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.EPSS 1.8%8.8CVE-2017-5826Hp aruba clearpass policy manager vulnerabilityAn authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.EPSS 3.3%8.1CVE-2017-9001Hp aruba clearpass policy manager vulnerabilityAruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through…EPSS 7.3%8.1CVE-2017-5828Hp aruba clearpass policy manager xml external entity (xxe) vulnerabilityAn arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.EPSS 1.9%7.8CVE-2017-5829Hp aruba clearpass policy manager vulnerabilityAn access restriction bypass vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.EPSS 0.59%7.5CVE-2018-5390Linux kernel TCP out-of-order queue processing denial of serviceLinux kernel versions 4.9 and later can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incomi…EPSS 74%analysed

Source: NIST National Vulnerability Database (record CVE-2018-7059), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.