CVE-2025-23057

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arubanetworks:fabric_composer:*:*:*:*:*:*:*:*

History

28 Mar 2025, 19:03

Type	Values Removed	Values Added
References	~~() https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US -~~	() https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US - Vendor Advisory
CPE		cpe:2.3:a:arubanetworks:fabric_composer::::::::
First Time		Arubanetworks Arubanetworks fabric Composer

13 Mar 2025, 15:15

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en la interfaz de administración web de HPE Aruba Networking Fabric Composer podría permitir que un atacante remoto autenticado realice un ataque Cross-Site Scripting (XSS) Almacenado. Si se aprovecha con éxito, un actor de amenazas podría ejecutar código script arbitrario en el navegador web de una víctima dentro del contexto de la interfaz comprometida.
CWE		CWE-79

28 Jan 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-28 18:15

Updated : 2025-03-28 19:03

NVD link : CVE-2025-23057

Mitre link : CVE-2025-23057

CVE.ORG link : CVE-2025-23057

JSON object : View

Products Affected

arubanetworks

fabric_composer

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-23057", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2025-01-28T18:15:39.677", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de administraci\u00f3n web de HPE Aruba Networking Fabric Composer podr\u00eda permitir que un atacante remoto autenticado realice un ataque Cross-Site Scripting (XSS) Almacenado. Si se aprovecha con \u00e9xito, un actor de amenazas podr\u00eda ejecutar c\u00f3digo script arbitrario en el navegador web de una v\u00edctima dentro del contexto de la interfaz comprometida."}], "lastModified": "2025-03-28T19:03:27.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:fabric_composer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BE4C645-BEDA-478A-8003-89A8AC66F9AD", "versionEndExcluding": "7.1.1", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}