logo_clicknbuy.png

CVE-2025-22273 – CyberArk Endpoint Privilege Manager Unbounded Brute Force Password Change

The following table lists the changes that have been made to the
CVE-2025-22273 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Feb. 28, 2025

    Action Type Old Value New Value
    Added Description Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the “/EPMUI/VfManager.asmx/ChangePassword” endpoint it is possible to perform a brute force attack on the current password in use.

    This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
    Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-770
    Added Reference https://cert.pl/en/posts/2025/02/CVE-2025-22270/
    Added Reference https://cert.pl/posts/2025/02/CVE-2025-22270/
    Added Reference https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
Share the Post:

Related Posts