CVE-2025-23058 — Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface

Description (CNA)

A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges.

Affected (CNA)

Vendor / product	Versions
Hewlett Packard Enterprise (HPE) / HPE Aruba Networking ClearPass Policy Manager	affected 6.12.0 through <=6.12.3; affected 6.11.0 through <=6.11.9

CWE

No CWE identifiers supplied.

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.