VULNERABILITY INTELLIGENCE

CVE-2018-7063

CVSS score8.1 HIGH
EPSS probability0.85%
CISA KEVNot currently listed
Published2018-12-07
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.

Weakness classification

  • CWE-611: Improper Restriction of XML External Entity Reference

Primary references