CVE-2025-37160CWE-200information-disclosure

CVE-2025-37160

Medium · published November 19, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-11-19T00:15Z
Affected products (5)
ProductVersionsFixed in
hpe/arubaos-cx≥ 10.10.0000, < 10.10.117010.10.1170
hpe/arubaos-cx≥ 10.13.0000, < 10.13.110110.13.1101
hpe/arubaos-cx≥ 10.14.0000, < 10.14.106010.14.1060
hpe/arubaos-cx≥ 10.15.0000, < 10.15.103010.15.1030
hpe/arubaos-cx≥ 10.16.0000, < 10.16.100110.16.1001
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 18 NOV 18:54Z
    Authenticated Broken Access Control (BAC) in REST API Configuration Service
    cvelistv5