Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2025-22273

Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CyberArk Endpoint Privilege Manager

Default version status: unknown

  • 24.7.1affected

References