CVE-2025-22273

Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager

Critical9.3EPSS 0.62%

Published: 28 Feb 2025
Updated: 5 Mar 2025
Reserved: 2 Jan 2025
Assigned by: CERT-PL

Description

Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Timeline

2025
2 Jan 2025
2 Jan 2025
ID reserved
By CERT-PL
28 Feb 202557 days later
28 Feb 2025· 57 days later
Published
5 Mar 20255 days later
5 Mar 2025· 5 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-22273, by who scored it
Scored by	CVSS	Score	Vector
CERT-PLCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
NVDNVD · Deferred	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.62% · top 50% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs

Affected products

CyberArk · Endpoint Privilege Manager
- affected 24.7.1

References (3)

https://cert.pl/en/posts/2025/02/CVE-2025-22270/ (opens in a new tab)third-party-advisory
https://cert.pl/posts/2025/02/CVE-2025-22270/ (opens in a new tab)third-party-advisory
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm (opens in a new tab)product

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-22273](https://trackcve.app/badge/CVE-2025-22273.svg)](https://trackcve.app/cve/CVE-2025-22273)

Record last updated 5 Mar 2025, 15:53 UTC.