CVE-2025-22270

An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/02/CVE-2025-22270/
https://cert.pl/posts/2025/02/CVE-2025-22270/
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm

Configurations

No configuration.

History

05 Mar 2025, 16:15

Type	Values Removed	Values Added
Summary		(es) Un atacante con acceso al panel de administración, específicamente a la pestaña "Administración de roles", puede inyectar código agregando un nuevo rol en el campo "nombre". Sin embargo, cabe señalar que el riesgo de explotar la vulnerabilidad se reduce debido al error adicional requerido que permite eludir la política Content-Security-Policy, que mitiga la ejecución de código JS al tiempo que permite la inyección de HTML. Este problema afecta a CyberArk Endpoint Privilege Manager en la versión SaaS 24.7.1. Se desconoce el estado de otras versiones. Después de varios intentos de contactar al proveedor, no recibimos ninguna respuesta.

28 Feb 2025, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-28 13:15

Updated : 2025-03-05 16:15

NVD link : CVE-2025-22270

Mitre link : CVE-2025-22270

CVE.ORG link : CVE-2025-22270

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-22270", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "cvd@cert.pl"}], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-02-28T13:15:27.447", "references": [{"url": "https://cert.pl/en/posts/2025/02/CVE-2025-22270/", "source": "cvd@cert.pl"}, {"url": "https://cert.pl/posts/2025/02/CVE-2025-22270/", "source": "cvd@cert.pl"}, {"url": "https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An attacker with access to the Administration panel, specifically the \"Role Management\"\ntab, can\ninject code by adding a new role in the \"name\" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the\nrequired additional error that allows bypassing the Content-Security-Policy policy, which\nmitigates JS code execution while still allowing HTML injection.\n\n\nThis issue affects\u00a0CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown.\u00a0After multiple attempts to contact the vendor we did not receive any answer."}, {"lang": "es", "value": "Un atacante con acceso al panel de administraci\u00f3n, espec\u00edficamente a la pesta\u00f1a \"Administraci\u00f3n de roles\", puede inyectar c\u00f3digo agregando un nuevo rol en el campo \"nombre\". Sin embargo, cabe se\u00f1alar que el riesgo de explotar la vulnerabilidad se reduce debido al error adicional requerido que permite eludir la pol\u00edtica Content-Security-Policy, que mitiga la ejecuci\u00f3n de c\u00f3digo JS al tiempo que permite la inyecci\u00f3n de HTML. Este problema afecta a CyberArk Endpoint Privilege Manager en la versi\u00f3n SaaS 24.7.1. Se desconoce el estado de otras versiones. Despu\u00e9s de varios intentos de contactar al proveedor, no recibimos ninguna respuesta."}], "lastModified": "2025-03-05T16:15:37.797", "sourceIdentifier": "cvd@cert.pl"}