PT-2025-9092 · Cyberark · Cyberark Endpoint Privilege Manager

Karol Mazurek + 3 · Publicado 2025-02-28 · Atualizado 2025-03-04 · CVE-2025-22273

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager in SaaS version 24.7.1

Description The application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint, it is possible to perform a brute force attack on the current password in use.

Recommendations For CyberArk Endpoint Privilege Manager in SaaS version 24.7.1, consider implementing rate limiting on the "/EPMUI/VfManager.asmx/ChangePassword" endpoint to prevent brute force attacks until a patch is available. As a temporary workaround, restrict access to this endpoint to minimize the risk of exploitation.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2025-22273

Produtos afetados

Cyberark Endpoint Privilege Manager

Referências · 13

• https://twitter.com/CVEnew/status/1895619319998087657 · Publicação no Twitter
• https://t.me/latest_high_impact_cve/1886 · Publicação no Telegram
• https://twitter.com/DarkWebInformer/status/1895515914654925292 · Publicação no Twitter
• https://twitter.com/DarkWebInformer/status/1896716325948670434 · Publicação no Twitter
• https://cert.pl/posts/2025/02/CVE-2025-22270 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-22273 · Nota de Segurança
• https://cert.pl/en/posts/2025/02/CVE-2025-22270 · Nota
• https://t.me/cvedetector/19155 · Publicação no Telegram
• https://twitter.com/UndercodeUpdate/status/1896901884084187370 · Publicação no Twitter
• https://t.me/thedarkwebinformer/13846 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1895580190891241601 · Publicação no Twitter
• https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm · Nota
• https://twitter.com/CveFindCom/status/1895459332780683495 · Publicação no Twitter