CVE-2014-8367

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-25 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) 6.2.x, 6.3.x before 6.3.6, and 6.4.x before 6.4.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected products

Aruba ClearPass Policy Manager: from 6.2.0 through 6.2.6; from 6.3.0 before 6.3.6; from 6.4.0 before 6.4.2; 6.2 — fixed in 6.3.6, 6.4.2

How to fix

Upgrade to a fixed version: Aruba ClearPass Policy Manager 6.3.6, 6.4.2. Check the vendor advisory for mitigations.

References

http://secunia.com/advisories/62602
http://www.arubanetworks.com/support/alerts/aid-11192014.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/98870
http://secunia.com/advisories/62602
http://www.arubanetworks.com/support/alerts/aid-11192014.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/98870

Get alerted when CVE-2014-8367 or the next vulnerability affects your stack