CVE-2025-23054

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-230555.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230565.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230575.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230588.1A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote atta CVE-2025-230594.9A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensit CVE-2025-23065.9An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sens CVE-2025-230608.1A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information.CVE-2025-230619.8Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exist CVE-2025-23077.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Infor CVE-2025-230725.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki CVE-2025-230733.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows CVE-2025-230742.4Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows