CVE-2025-23054
Authenticated Response Manipulation allows Unauthorized Actions in Management Interface
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jan 28, 2025
- Updated
- Mar 13, 2025
- Reserved
- Jan 10, 2025
Description
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | hpe |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
HPE Aruba Networking Fabric Composer (AFC)Hewlett Packard Enterprise (HPE) |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.