CVE-2023-25591Incorrect Privilege Assignment in Clearpass Policy Manager

Severity
6.5MEDIUMNVD
CNA7.6
EPSS
0.2%
top 60.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 22

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further privileges on the ClearPass instance.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

CVEListV5hewlett_packard_enterprise/aruba_clearpass_policy_manager6.10.8 and below, 6.11.1 and below, 6.9.13 and below+2

🔴Vulnerability Details

2
GHSA
GHSA-6x3m-hh2g-4gwp: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to a2023-03-22
CVEList
Authenticated Information Disclosure in ClearPass Policy Manager Web-Based Management Interface2023-03-14
CVE-2023-25591 — Incorrect Privilege Assignment | cvebase