Authenticated Stored Cross-Site Scripting (XSS) in HPE Aruba Networking ClearPass Policy Manager Web-based Management Interface

published 2024-12-03 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-45764

cvss: 4.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session.

Patch / fix

fixed in 1

arubanetworks clearpass_policy_manager 6.11.10, 6.12.3

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago (2024-12-03)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

support.hpe.com /hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US
vendor-advisory

Sources

CVE List CVE-2024-51773
NVD CVE-2024-51773

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary