← Back

CVE-2023-25594

nvd nist
Published: Mar 22, 2023Modified: Feb 27, 2025

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.

Affected (4)

Arubanetworks
1 product
Clearpass Policy Manager
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Arubanetworks
Clearpass Policy Manager
From 6.10.0 to 6.10.8
Clearpass Policy Manager
From 6.9.0 to 6.9.13
Clearpass Policy Manager
Version 6.11.0
Clearpass Policy Manager
Version 6.11.1

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

Source: security-alert@hpe.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.