CVE-2025-23058: arubanetworks clearpass_policy_manager Weak Authentication

Vulnerability summary

CVE-2025-23058 is a high (CVSS 8.8) Weak Authentication vulnerability in arubanetworks clearpass_policy_manager. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.1% of scored vulnerabilities.

Timeline

1. 04-02-2025
   PublishedVulnerability first disclosed.
2. 13-03-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges.

• CWE-1390Weak AuthenticationThe product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.