Skip to content
OpenAdvisories
High WID-SEC-2025-0261 5 CVEs

Aruba ClearPass Policy Manager: Mehrere Schwachstellen

Published Feb 4, 2025 · Updated Feb 4, 2025 · de-DE

Vendor: Aruba Product: ClearPass Policy Manager

Summary

Ein entfernter authentisierter Angreifer kann mehrere Schwachstellen in Aruba ClearPass Policy Manager ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und Daten zu manipulieren.

Product

Aruba ClearPass ist eine Netzwerk-Zugangskontrolllösung.

Vulnerabilities 5

  • High 8.8
    CVE-2024-7348

    PostgreSQL relation replacement during pg_dump executes arbitrary SQL

    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2025-23058

    Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface

    A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrato…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager
  • Medium 6.8
    CVE-2025-23059

    Sensitive Information Disclosure in HPE Aruba Networking ClearPass Policy Manager

    A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privil…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager
  • Medium 6.6
    CVE-2025-23060

    Sensitive Data Exposure Vulnerability in HPE Aruba Networking ClearPass Policy Manager (CPPM)

    A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unau…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager
  • Medium 4.7
    CVE-2025-25039

    Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface

    A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking ClearPass Policy Manager

Revision history

  1. #1

    Initiale Fassung

References