CVE-2023-25591 — Incorrect Privilege Assignment in Clearpass Policy Manager
Severity
6.5MEDIUMNVD
CNA7.6
EPSS
0.2%
top 60.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 22
Description
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further privileges on the ClearPass instance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages2 packages
▶CVEListV5hewlett_packard_enterprise/aruba_clearpass_policy_manager6.10.8 and below, 6.11.1 and below, 6.9.13 and below+2
🔴Vulnerability Details
2GHSA▶
GHSA-6x3m-hh2g-4gwp: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to a↗2023-03-22
CVEList▶
Authenticated Information Disclosure in ClearPass Policy Manager Web-Based Management Interface↗2023-03-14