PT-2018-11461 · Cyberark · Cyberark Endpoint Privilege Manager

Code16 · Published 2018-06-26 · Updated 2018-08-30 · CVE-2018-12903

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager version 10.2.1.603

Description The issue concerns a persistent XSS vulnerability. It can be triggered via an account name on the create token screen, the VfManager.asmx SelectAccounts->DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application Group Wizard.

Recommendations For version 10.2.1.603, consider restricting access to the create token screen, VfManager.asmx, ConfigurationPage, and Application Group Wizard until a patch is available. As a temporary workaround, avoid using potentially malicious account names, DisplayNames, group names, Dialog Titles, and App Group Names in the affected screens and wizards. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-12903

Affected Products

Cyberark Endpoint Privilege Manager

References · 3

• 🔥 http://code610.blogspot.com/2018/06/exploiting-cyberark-1021603.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12903 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12903 · Vendor Advisory