CVE-2025-22272: Self Reflected XSS in CyberArk Endpoint Privilege Manager
In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the Content-Security-Policy policy
This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22272?
CVE-2025-22272 has a moderate severity due to the potential for code injection through the modalDlgMsgInternal parameter.
How do I fix CVE-2025-22272?
To fix CVE-2025-22272, ensure that user input is properly sanitized and validated before processing.
Which software is affected by CVE-2025-22272?
CVE-2025-22272 affects CyberArk Endpoint Privilege Manager specifically at the mentioned endpoint.
What are the potential consequences of exploiting CVE-2025-22272?
Exploiting CVE-2025-22272 could allow an attacker to execute arbitrary code in the browser, potentially leading to data exposure or other malicious actions.
Is there a workaround for CVE-2025-22272?
While waiting for a patch for CVE-2025-22272, consider restricting access to the vulnerable endpoint to trusted users only.