Back to Database
Status published
Medium
CVE-2015-1389
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager...
Vulnerability Description
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-1389
Credits & Attribution
No credits recorded in the NVD database.
References
- http://packetstormsecurity.com/files/132060/Aruba-ClearPass-Policy-Manager-6.4-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/37172/
- http://seclists.org/fulldisclosure/2015/May/115
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt
- https://github.com/cmaruti/reports/blob/master/aruba_clearpass.pdf
More from arubanetworks
View All →CVE-2018-16417
Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11,...
High
7.5
CVE-2016-4401
Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2...
Critical
9.8
CVE-2016-2034
SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6...
Critical
9.8
CVE-2016-2032
A vulnerability exists in the Aruba AirWave Management Platform 8.x...
High
7.5
CVE-2016-2031
Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1...
Critical
9.8
Affected Vendor
arubanetworks
View all reports →Affected Software
clearpass policy manager
Vulnerable Versions:
0
Timeline
Official Publish:
May 28th, 2015
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.