Read the docs
TI-2024-17380 Aliases CVE-2024-26299GHSA-j6mw-3p6q-wxcc

Cross-site scripting in Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00358 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hewlett Packard Enterprise (HPE)Aruba ClearPass Policy ManagerClearPass Policy Manager 6.12.x: 6.12.0 and later; ClearPass Policy Manager 6.11.x: 6.11.6 and below and later; ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below and later; ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below and later—No fix listedCNA
  • Aruba ClearPass Policy Manager VendorHewlett Packard Enterprise (HPE) Affected ClearPass Policy Manager 6.12.x: 6.12.0 and later; ClearPass Policy Manager 6.11.x: 6.11.6 and below and later; ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below and later; ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below and later Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*6.9.0 to before 6.9.13; 6.10.0 to before 6.10.8; 6.11.0 – 6.11.6VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-:*:*:*:*:*:*6.9.13VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2:*:*:*:*:*:*6.9.13 cumulative_hotfix_patch_2VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3:*:*:*:*:*:*6.9.13 cumulative_hotfix_patch_3VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_4:*:*:*:*:*:*6.9.13 cumulative_hotfix_patch_4VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-:*:*:*:*:*:*6.10.8VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2:*:*:*:*:*:*6.10.8 cumulative_hotfix_patch_2VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5:*:*:*:*:*:*6.10.8 cumulative_hotfix_patch_5VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_6:*:*:*:*:*:*6.10.8 cumulative_hotfix_patch_6VulnerableArubanetworks
cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.12.0:*:*:*:*:*:*:*6.12.0VulnerableArubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:* Versions 6.9.0 to before 6.9.13; 6.10.0 to before 6.10.8; 6.11.0 – 6.11.6 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:-:*:*:*:*:*:* Versions 6.9.13 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_2:*:*:*:*:*:* Versions 6.9.13 cumulative_hotfix_patch_2 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_3:*:*:*:*:*:* Versions 6.9.13 cumulative_hotfix_patch_3 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.9.13:cumulative_hotfix_patch_4:*:*:*:*:*:* Versions 6.9.13 cumulative_hotfix_patch_4 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:-:*:*:*:*:*:* Versions 6.10.8 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_2:*:*:*:*:*:* Versions 6.10.8 cumulative_hotfix_patch_2 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_5:*:*:*:*:*:* Versions 6.10.8 cumulative_hotfix_patch_5 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.10.8:cumulative_hotfix_patch_6:*:*:*:*:*:* Versions 6.10.8 cumulative_hotfix_patch_6 Vulnerable ·Arubanetworks
  • cpe:2.3:a:arubanetworks:clearpass_policy_manager:6.12.0:*:*:*:*:*:*:* Versions 6.12.0 Vulnerable ·Arubanetworks

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-26299
  2. 2026-10-03 Alias added: GHSA-j6mw-3p6q-wxcc

References

Other 1

  • TI-2025-25062 A remote code execution issue exists in HPE OneView. KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-03684 Improper privilege management in Intel Active Mangement Technology, Intel Small Business… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2024-35876 Path traversal in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1CRITICAL 9.8
  • TI-2020-05748 A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could… CVSS 3.1CRITICAL 9.8
  • TI-2024-35875 XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1HIGH 7.5
See all 927 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences