CVE-2025-23060
Published: 04 February 2025
Description
A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unauthorized access to network resources as well as enabling data tampering.
Security Summary
CVE-2025-23060 is a vulnerability in HPE Aruba Networking ClearPass Policy Manager that may, under certain circumstances, expose sensitive unencrypted information. Classified under CWE-319 (Cleartext Transmission of Sensitive Information), it carries a CVSS v3.1 base score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-04.
The vulnerability can be exploited over the network by an attacker possessing high privileges (PR:H), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation enables a man-in-the-middle attack, potentially granting unauthorized access to network resources and allowing data tampering, with high impacts on confidentiality, integrity, and availability.
Mitigation details are available in the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US.
Details
- CWE(s)