Login Request a demo
Medium severity · published Feb 4, 2025
CVE-2025-23059
Sensitive Information Disclosure in HPE Aruba Networking ClearPass Policy Manager
4.9
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive data, potentially compromising the integrity and security of the entire system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
HPE Aruba Networking ClearPass Policy Manager · Hewlett Packard Enterprise (HPE)
6.12.0 through <=6.12.3; 6.11.0 through <=6.11.9 · source: vendor
CP
Clearpass Policy Manager · Arubanetworks
6.11.0 before 6.11.10; 6.12.0 before 6.12.4 · source: NVD
Affected product
HA
HPE Aruba Networking ClearPass Policy Manager
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-23059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-23059
Vendor Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
More from HPE Aruba Networking ClearPass Policy Manager
8.8
CVE-2025-25039
Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface
8.8
CVE-2024-51771
Authenticated Remote Code Execution (RCE) via OGNL Injection in HPE Aruba Networking ClearPass Web-Based Management Interface
8.1
CVE-2025-23060
Sensitive Data Exposure Vulnerability in HPE Aruba Networking ClearPass Policy Manager (CPPM)
8.1
CVE-2025-23058
Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface
8.0
CVE-2024-51772
Authenticated Deserialization Vulnerability in ClearPass Policy Manager Web-Based Management Interface Leading to a Remote Command Execution (RCE)