Riskcovery

CVE-2023-43508

Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface

State
Published
Severity
6.3 Medium
Published
Oct 24, 2023
Updated
Sep 11, 2024
Reserved
Sep 19, 2023

Read the record on cve.org

Description

Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lhpe

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Aruba ClearPass Policy ManagerHewlett Packard Enterprise (HPE)
  • ClearPass Policy Manager 6.11.x: 6.11.4 and below through <=6.11.4Affected
  • ClearPass Policy Manager 6.10.x: 6.10.8 with ClearPass 6.10.8 Cumulative Hotfix Patch 5 and belowAffected
  • ClearPass Policy Manager 6.9.x: 6.9.13 with ClearPass 6.9.13 Cumulative Hotfix Patch 3 and belowAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.