CVE-2023-25591: arubanetworks clearpass_policy_manager Incorrect Privilege Assignment

Vulnerability summary

CVE-2023-25591 is a high (CVSS 7.6) Incorrect Privilege Assignment vulnerability in arubanetworks clearpass_policy_manager. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.3% of scored vulnerabilities.

Timeline

1. 14-03-2023
   PublishedVulnerability first disclosed.
2. 27-02-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further privileges on the ClearPass instance.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.