{"id":"CVE-2025-22270","state":"PUBLISHED","title":"Stored XSS in CyberArk Endpoint Privilege Manager","description":"An attacker with access to the Administration panel, specifically the \"Role Management\"\ntab, can\ninject code by adding a new role in the \"name\" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the\nrequired additional error that allows bypassing the Content-Security-Policy policy, which\nmitigates JS code execution while still allowing HTML injection.\n\n\nThis issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.","publishedAt":"2025-02-28T12:32:33.243Z","updatedAt":"2025-03-05T15:48:53.149Z","severity":{"score":7.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["CyberArk Endpoint Privilege Manager"],"affected":[{"vendor":"CyberArk","product":"Endpoint Privilege Manager","defaultStatus":"unknown","versions":[{"version":"24.7.1","status":"affected"}],"platforms":["SaaS"]}],"references":["https://cert.pl/en/posts/2025/02/CVE-2025-22270/","https://cert.pl/posts/2025/02/CVE-2025-22270/","https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/22xxx/CVE-2025-22270.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-22270","state":"PUBLISHED","datePublished":"2025-02-28T12:32:33.243Z","dateUpdated":"2025-03-05T15:48:53.149Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2025-01-02T13:12:19.641Z"},"containers":{"cna":{"title":"Stored XSS in CyberArk Endpoint Privilege Manager","descriptions":[{"lang":"en","value":"An attacker with access to the Administration panel, specifically the \"Role Management\"\ntab, can\ninject code by adding a new role in the \"name\" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the\nrequired additional error that allows bypassing the Content-Security-Policy policy, which\nmitigates JS code execution while still allowing HTML injection.\n\n\nThis issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer."}],"affected":[{"vendor":"CyberArk","product":"Endpoint Privilege Manager","defaultStatus":"unknown","versions":[{"version":"24.7.1","status":"affected"}],"platforms":["SaaS"]}],"references":[{"url":"https://cert.pl/en/posts/2025/02/CVE-2025-22270/","tags":["third-party-advisory"]},{"url":"https://cert.pl/posts/2025/02/CVE-2025-22270/","tags":["third-party-advisory"]},{"url":"https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.3,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2025-03-05T15:48:53.149Z"},"credits":[{"lang":"en","type":"finder","value":"Karol Mazurek (Afine Team)"},{"lang":"en","type":"finder","value":"Maksymilian Kubiak (Afine Team)"}],"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"source":{"discovery":"UNKNOWN"},"tags":["exclusively-hosted-service"],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-28T13:06:34.047496Z","id":"CVE-2025-22270","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-28T13:06:46.068Z"}}]}}}