Vulnerability record/PUBLISHED/Published Feb 28, 2025 12:34:08 UTC

CVE-2025-22274

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Base score2.0/ 10

SeverityLowCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsPresentAT

Privileges requiredLowPR

User interactionActiveUI

Vulnerable system confidentialityNoneVC

Vulnerable system integrityLowVI

Vulnerable system availabilityLowVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityCERT-PL

Last updatedMar 12, 2025 19:50:46 UTC

PublishedFeb 28, 2025 12:34:08 UTC

ReservedJan 2, 2025 13:12:19 UTC

Credits

Karol Mazurek (Afine Team)
Maksymilian Kubiak (Afine Team)