CVE-2023-25596 — Cleartext Storage of Sensitive Info in Clearpass Policy Manager

CWE-312 — Cleartext Storage of Sensitive Info3 documents3 sources
Severity
4.9MEDIUMNVD
CNA4.5
EPSS
0.1%
top 66.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Arubanetworks Clearpass Policy ManagerHewlett Packard Enterprise Aruba Clearpass Policy Manager
Timeline
PublishedMar 22

Description

A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5hewlett_packard_enterprise/aruba_clearpass_policy_manager6.10.8 and below, 6.11.1 and below, 6.9.13 and below+2

🔴Vulnerability Details

2
GHSA
GHSA-6p72-fpqv-2cff: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cle↗2023-03-22
▶
CVEList
Authenticated Sensitive Information Disclosure in ClearPass Policy Manager↗2023-03-14
▶
CVE-2023-25596 — Cleartext Storage of Sensitive Info | cvebase