CVE-2025-22274lowCWE-80

CVE-2025-22274: falha de baixa gravidade em CyberArk Endpoint Privilege Manager

HTML injection in CyberArk Endpoint Privilege Manager

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Endpoint Privilege Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2epss 0.5%
It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
CyberArk · Endpoint Privilege Manager
CVEs relacionadas — CyberArk Endpoint Privilege Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2025-22270HIGHStored XSS in CyberArk Endpoint Privilege ManagerEPSS 0.6%CVE-2025-22273CRITICALLack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege ManagerEPSS 0.6%CVE-2025-22272LOWSelf Reflected XSS in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2025-22271MEDIUMIP Spoofing in CyberArk Endpoint Privilege ManagerEPSS 0.4%