CVE-2025-22274: HTML injection in CyberArk Endpoint Privilege Manager

2.0 CVSS

Description

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page.

This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Classification

CVE ID: CVE-2025-22274

CVSS Base Severity: LOW

CVSS Base Score: 2.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Problem Types

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Affected Products

Vendor: CyberArk

Product: Endpoint Privilege Manager

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 6.27% (scored less or equal to compared to others)

EPSS Date: 2025-03-29 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-22274
https://cert.pl/en/posts/2025/02/CVE-2025-22270/
https://cert.pl/posts/2025/02/CVE-2025-22270/
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm

Timeline