Cross-site scripting in Hewlett Packard Enterprise Aruba ClearPass
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into ClearPass in the same browser.
Why it matters now
EPSS 0.00922 60th percentileScored 2026-11-07
Fix Fixed Aruba ClearPass (Hewlett Packard Enterprise): v6.6.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise | Aruba ClearPass | before v6.6.8 | v6.6.8 | Patch available | CNA |
- Aruba ClearPass VendorHewlett Packard Enterprise Affected before v6.6.8 Fixed in v6.6.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:aruba_clearpass_policy_manager:*:*:*:*:*:*:*:* | before 6.6.8 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:aruba_clearpass_policy_manager:*:*:*:*:*:*:*:* Versions before 6.6.8 Vulnerable ·Hewlett Packard Enterprise
Remediation
- Fix · CNA Aruba ClearPass (Hewlett Packard Enterprise) Fixed in v6.6.8
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9002
- 2026-10-03 Alias added: GHSA-2xwj-rw2w-xr5q
References
More Hewlett Packard Enterprise Aruba Clearpass Policy Manager vulnerabilities
- TI-2018-03923 Uncontrolled resource consumption in Linux Kernel CVSS 3.1HIGH 7.5
- TI-2017-03762 An unauthenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found. CVSS 3.0CRITICAL 9.8
- TI-2018-05123 Improper authentication in Hewlett Packard Enterprise Aruba ClearPass CVSS 3.0CRITICAL 9.8
- TI-2017-06487 Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes… CVSS 3.0HIGH 8.1
- TI-2017-03764 An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found. CVSS 3.0HIGH 8.8
- TI-2017-03763 A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found. CVSS 3.0HIGH 8.8
Sources
- CVE-2017-9002 · CVE Program
- CVE-2017-9002 · NVD
- FIRST EPSS
- GHSA-2xwj-rw2w-xr5q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences