CVE-2020-7111: 
Aruba ClearPass vulnerability analysis and mitigation

A server-side injection vulnerability (CVE-2020-7111) was identified in ClearPass that could allow an authenticated administrative user to achieve Remote Code Execution. The vulnerability affects ClearPass Policy Manager versions 6.7.x prior to 6.7.13, and versions 6.8.x prior to 6.8.4 (CERT-FR, CVE-MITRE).

The vulnerability was disclosed on April 14, 2020, and involves a server-side injection flaw that could be exploited by authenticated administrative users to execute arbitrary code remotely on affected systems. The issue was assigned CVE-2020-7111 and required administrative access for successful exploitation (CERT-FR).

If successfully exploited, this vulnerability could allow authenticated administrative users to execute arbitrary code remotely on the affected ClearPass systems, potentially leading to complete system compromise (CERT-FR).

The vulnerability requires authentication and administrative access for successful exploitation, which somewhat limits its potential impact. However, any authenticated administrative user could potentially leverage this vulnerability to achieve remote code execution (CVE-MITRE).

The vulnerability has been fixed in ClearPass versions 6.7.13, 6.8.4, 6.9.0 and higher. Organizations using affected versions should upgrade to the patched versions to mitigate this security risk (CVE-MITRE).