CVE-2025-22272lowCWE-79

CVE-2025-22272: fallo de gravedad baja en CyberArk Endpoint Privilege Manager

Self Reflected XSS in CyberArk Endpoint Privilege Manager

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Endpoint Privilege Manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.1epss 0.5%
In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the Content-Security-Policy policy This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Productos afectados
CyberArk · Endpoint Privilege Manager
CVEs relacionadas — CyberArk Endpoint Privilege Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-22270HIGHStored XSS in CyberArk Endpoint Privilege ManagerEPSS 0.6%CVE-2025-22273CRITICALLack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege ManagerEPSS 0.6%CVE-2025-22274LOWHTML injection in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2025-22271MEDIUMIP Spoofing in CyberArk Endpoint Privilege ManagerEPSS 0.4%