PT-2025-9093 · Cyberark · Cyberark Endpoint Privilege Manager

Karol Mazurek + 3 · Published 2025-02-28 · Updated 2025-02-28 · CVE-2025-22274

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager version 24.7.1

Description The issue allows for HTML code injection into the page content through the content field in the Application definition page. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For version 24.7.1, consider restricting access to the content field in the Application definition page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-22274

Affected Products

Cyberark Endpoint Privilege Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-22274 · Security Note
• https://cert.pl/en/posts/2025/02/CVE-2025-22270 · Note
• https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm · Note
• https://twitter.com/CVEnew/status/1895619319129915857 · Twitter Post
• https://cert.pl/posts/2025/02/CVE-2025-22270 · Note
• https://twitter.com/cybercronai/status/1895583631902445912 · Twitter Post
• https://t.me/cvedetector/19149 · Telegram Post