by Kastro
Paper/Archive/CVE-2023-25589

CVE-2023-25589

Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager — Unauthenticated Arbitrary User Creation Leads to Complete System Compromise

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.6.616 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise.

Affected

ProductAffectedFixed inSource
Aruba ClearPass Policy Manager6.11.1 and below–CNA
Aruba ClearPass Policy Manager6.10.8 and below–CNA
Aruba ClearPass Policy Manager6.9.13 and below–CNA

Scores by source

hpe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refarubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt