CVE-2025-22273: falha crítica em CyberArk Endpoint Privilege Manager
Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.6%
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use.
This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
CyberArk · Endpoint Privilege ManagerCVEs relacionadas — CyberArk Endpoint Privilege Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2025-22270HIGHStored XSS in CyberArk Endpoint Privilege ManagerEPSS 0.6%CVE-2025-22274LOWHTML injection in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2025-22272LOWSelf Reflected XSS in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2025-22271MEDIUMIP Spoofing in CyberArk Endpoint Privilege ManagerEPSS 0.4%