Log in Start free

Vulnerability · Published Feb 4, 2025 · Assigned by hpe

CVE-2025-23058Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface

High 8.8

In plain English

A high-severity security flaw in HPE Aruba Networking ClearPass Policy Manager from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges.

Affected products (as reported)

VendorProductVersions
Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager 6.12.0 – through <=6.12.36.11.0 – through <=6.11.9

Weakness: CWE-1390 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References