CVE-2023-25594 MEDIUM

CVE-2023-25594: Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface

Vendor Hewlett Packard Enterprise (Hpe)
Product Aruba ClearPass Policy Manager
Published March 14, 2023
Last update February 27, 2025

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.

Key dates

02Disclosure timeline

March 14, 2023 CVE published
February 27, 2025 Record updated