PT-2020-16071 · Cyberark · Cyberark Privileged Session Manager

Published 2020-10-28 · Updated 2020-12-02 · CVE-2020-25374

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CyberArk Privileged Session Manager (PSM) version 10.9.0.15

Description The issue allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.

Recommendations For version 10.9.0.15, consider implementing a workaround to restrict access to error messages or limit the information disclosed in error popup messages until a fix is available.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-25374

Affected Products

Cyberark Privileged Session Manager

References · 5

• 🔥 https://medium.com/@virajmota38/full-path-disclosure-8a9358e5a867 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25374 · Vendor Advisory
• https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PAS%20SysReq/System%20Requirements%20-%20PSM.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25374 · Security Note
• https://medium.com/%40virajmota38/full-path-disclosure-8a9358e5a867 · Note