CVE-2021-29145: 
Aruba ClearPass vulnerability analysis and mitigation

A remote server side request forgery (SSRF) remote code execution vulnerability (CVE-2021-29145) was discovered in Aruba ClearPass Policy Manager versions prior to 6.9.5, 6.8.9, and 6.7.14-HF1. The vulnerability was disclosed in April 2021 and received a critical CVSS v3.1 base score of 9.8 (NVD).

The vulnerability is classified as a Server-Side Request Forgery (SSRF) that can lead to remote code execution. It has been assigned CWE-918 (Server-Side Request Forgery). The CVSS v3.1 scoring metrics indicate the vulnerability has network-based attack vector (AV:N), low attack complexity (AC:L), requires no privileges (PR:N), needs no user interaction (UI:N), has unchanged scope (S:U), and can result in high impact to confidentiality, integrity and availability (C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to complete system compromise. The critical CVSS score of 9.8 indicates the severe potential impact on the confidentiality, integrity, and availability of the affected systems (Qualys Research).

The vulnerability is considered highly exploitable due to its network-based attack vector and low attack complexity. It requires no special privileges or user interaction to exploit, making it particularly dangerous. The vulnerability was listed among those that are more likely to be exploited (Qualys Research).

Aruba has released patches to address this security vulnerability. Organizations running affected versions of ClearPass Policy Manager should upgrade to versions 6.9.5, 6.8.9, or 6.7.14-HF1 or later (NVD).