PT-2025-5374 · Broadcom · Symantec Privileged Access Management

Stefan Grönke · Published 2025-01-30 · Updated 2025-02-05 · CVE-2025-24502

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2025-24502

Affected Products

Symantec Privileged Access Management

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-24502 · Security Note
• https://t.me/cvenotify/109280 · Telegram Post
• https://t.me/cvenotify/110065 · Telegram Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678 · Note
• https://twitter.com/CVEnew/status/1885036054010384454 · Twitter Post
• https://t.me/cvenotify/109291 · Telegram Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362 · Note