CVEvulnerability
CVE-2013-2269
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-10-01
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in conjunction with information from a "default holding page" to discover the link that is used for sponsor approval of the guest request, then performing a direct request to that link.
Affected configurations
• arubanetworks clearpass 5.0.1
• arubanetworks clearpass 5.1
• arubanetworks clearpass 5.2
• arubanetworks clearpass 6.0.1
• arubanetworks clearpass 6.0.2
• arubanetworks clearpass guest 3.0
• arubanetworks clearpass guest 3.1
• arubanetworks clearpass guest 3.2
• arubanetworks clearpass guest 3.3
• arubanetworks clearpass guest 3.5
• arubanetworks clearpass guest 3.7
• arubanetworks clearpass guest 3.9
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/53358 Vendor Advisory
- http://www.arubanetworks.com/support/alerts/aid-050813.asc Vendor Advisory
- http://www.securityfocus.com/bid/59805 www.securityfocus.com
- http://secunia.com/advisories/53358 Vendor Advisory
- http://www.arubanetworks.com/support/alerts/aid-050813.asc Vendor Advisory
- http://www.securityfocus.com/bid/59805 www.securityfocus.com