CVE-2025-23055

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE Aruba Networking Fabric Composer (AFC)	>= 7.0.0, <= 7.1.0

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_USVendor Advisory

Timeline

Published: Jan 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-230565.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230575.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230588.1A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote atta CVE-2025-230594.9A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensit CVE-2025-23065.9An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sens CVE-2025-230608.1A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information.CVE-2025-230619.8Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exist CVE-2025-23077.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Infor CVE-2025-230725.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki CVE-2025-230733.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows CVE-2025-230742.4Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows CVE-2025-230786.5Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki