Arubanetworks Clearpass Policy Manager vulnerabilities

CVE-2025-23060 [HIGH] CWE-319 CVE-2025-23060: A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, e A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unauthorized access to network resources as well as enabling data tampering.

CVE-2025-23058 [HIGH] CWE-1390 CVE-2025-23058: A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileg A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged use

CVE-2025-25039 [HIGH] CWE-78 CVE-2025-25039: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manag A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.

CVE-2025-23059 [MEDIUM] CWE-22 CVE-2025-23059: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manag A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive data, potentially compromising the integrity and securi

CVE-2024-51772 [HIGH] CWE-77 CVE-2024-51772: An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface al An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2024-51771 [HIGH] CWE-77 CVE-2024-51771: A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Successful exploitation could enable the attacker to run arbitrary commands on the underlying operating system.

CVE-2024-51773 [MEDIUM] CWE-79 CVE-2024-51773: A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering

CVE-2024-53672 [MEDIUM] CWE-77 CVE-2024-53672: A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authent A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.

CVE-2024-41915 [HIGH] CWE-89 CVE-2024-41915: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an aut A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete

CVE-2024-5486 [MEDIUM] CVE-2024-5486: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative p A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager

CVE-2024-41916 [MEDIUM] CVE-2024-41916: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative p A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.

CVE-2024-26298 [HIGH] CWE-77 CVE-2024-26298: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVE-2024-26294 [HIGH] CWE-77 CVE-2024-26294: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVE-2024-26296 [HIGH] CWE-77 CVE-2024-26296: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVE-2024-26297 [HIGH] CWE-77 CVE-2024-26297: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVE-2024-26295 [HIGH] CWE-77 CVE-2024-26295: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenti Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVE-2024-26302 [MEDIUM] CWE-276 CVE-2024-26302: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remo A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Man

CVE-2024-26301 [MEDIUM] CVE-2024-26301: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remo A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.

CVE-2024-26300 [MEDIUM] CWE-79 CVE-2024-26300: A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remo A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVE-2024-26299 [MEDIUM] CWE-79 CVE-2024-26299: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an aut A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affec