title: Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications
description: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
affected:
{
defaultStatus: unaffected
product: Aruba ClearPass Policy Manager
vendor: Hewlett Packard Enterprise (HPE)
versions:
lessThanOrEqual: <=6.11.4, status: affected, version: ClearPass Policy Manager 6.11.x: 6.11.4 and below, versionType: semver
status: affected, version: ClearPass Policy Manager 6.10.x: 6.10.8 with ClearPass 6.10.8 Cumulative Hotfix Patch 5 and below
status: affected, version: ClearPass Policy Manager 6.9.x: 6.9.13 with ClearPass 6.9.13 Cumulative Hotfix Patch 3 and below
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL