CVE-2023-43508

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	Aruba ClearPass Policy Manager	>= ClearPass Policy Manager 6.11.x: 6.11.4 and below, <= <=6.11.4; ClearPass Policy Manager 6.10.x: 6.10.8 with ClearPass 6.10.8 Cumulative Hotfix Patch 5 and below; ClearPass Policy Manager 6.9.x: 6.9.13 with ClearPass 6.9.13 Cumulative Hotfix Patch 3 and below

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txtVendor Advisory

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-435095.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send not CVE-2023-43518.8Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potential CVE-2023-435106.3A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands o CVE-2023-435117.5Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header CVE-2023-435127.5Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the CVE-2023-435137.8Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values CVE-2023-435147.8Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.CVE-2023-435157.8Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.CVE-2023-435167.8Memory corruption when malformed message payload is received from firmware.CVE-2023-435177.8Memory corruption in Automotive Multimedia due to improper access control in HAB.CVE-2023-435189.8Memory corruption in video while parsing invalid mp2 clip.CVE-2023-435199.8Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.