CVE-2025-23059

Sensitive Information Disclosure in HPE Aruba Networking ClearPass Policy Manager

State: Published
Severity: 6.8 Medium
Published: Feb 4, 2025
Updated: Mar 13, 2025
Reserved: Jan 10, 2025

Description

A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive data, potentially compromising the integrity and security of the entire system.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	hpe

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
HPE Aruba Networking ClearPass Policy ManagerHewlett Packard Enterprise (HPE)	6.12.0 through <=6.12.3Affected 6.11.0 through <=6.11.9Affected

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.