CVE-2025-22272
Self Reflected XSS in CyberArk Endpoint Privilege Manager
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the Content-Security-Policy policy This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the Content-Security-Policy policy This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2025-01-02 CVE Reserved
- 2025-02-28 CVE Published
- 2025-03-05 CVE Updated
- 2025-06-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
- CAPEC-591: Reflected XSS
References (3)
| URL | Tag | Source |
|---|---|---|
| https://cert.pl/en/posts/2025/02/CVE-2025-22270 | Third Party Advisory | |
| https://cert.pl/posts/2025/02/CVE-2025-22270 | Third Party Advisory | |
| https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm | Product |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| CyberArk Search vendor "CyberArk" | Endpoint Privilege Manager Search vendor "CyberArk" for product "Endpoint Privilege Manager" | 24.7.1 Search vendor "CyberArk" for product "Endpoint Privilege Manager" and version "24.7.1" | en |
Affected
| ||||||