CVE-2023-25592

Published: Mar 22, 2023Modified: Feb 27, 2025

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Affected (4)

Products: Arubanetworks: Clearpass Policy Manager

Arubanetworks

1 product

Clearpass Policy Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Arubanetworks Clearpass Policy Manager	From 6.10.0 to 6.10.8
Arubanetworks Clearpass Policy Manager	From 6.9.0 to 6.9.13
Arubanetworks Clearpass Policy Manager	Version 6.11.0
Arubanetworks Clearpass Policy Manager	Version 6.11.1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt

Source: security-alert@hpe.com

Vendor Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.