CVE-2023-25591

Summary

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further privileges on the ClearPass instance.

Affected Software

VendorProductVersion RangeStatus
Hewlett Packard Enterprise (HPE)Aruba ClearPass Policy Manager6.11.1 and belowaffected
Hewlett Packard Enterprise (HPE)Aruba ClearPass Policy Manager6.10.8 and belowaffected
Hewlett Packard Enterprise (HPE)Aruba ClearPass Policy Manager6.9.13 and belowaffected

Weaknesses

  • n/a

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References