CVE-2025-22272

Self Reflected XSS in CyberArk Endpoint Privilege Manager

Low2.1EPSS 0.46%

Published: 28 Feb 2025
Updated: 5 Mar 2025
Reserved: 2 Jan 2025
Assigned by: CERT-PL

Description

In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the Content-Security-Policy policy This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Timeline

2025
2 Jan 2025
2 Jan 2025
ID reserved
By CERT-PL
28 Feb 202557 days later
28 Feb 2025· 57 days later
Published
5 Mar 20255 days later
5 Mar 2025· 5 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-22272, by who scored it
Scored by	CVSS	Score	Vector
CERT-PLCNA (assigner)	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
NVDNVD · Deferred	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.46% · top 60% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.1.

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

CyberArk · Endpoint Privilege Manager
- affected 24.7.1

References (3)

https://cert.pl/en/posts/2025/02/CVE-2025-22270/ (opens in a new tab)third-party-advisory
https://cert.pl/posts/2025/02/CVE-2025-22270/ (opens in a new tab)third-party-advisory
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm (opens in a new tab)product

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-22272](https://trackcve.app/badge/CVE-2025-22272.svg)](https://trackcve.app/cve/CVE-2025-22272)

Record last updated 5 Mar 2025, 15:53 UTC.