CVE-2025-22273: Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use.
This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22273?
CVE-2025-22273 is considered a critical vulnerability due to its potential for enabling brute force attacks on user passwords.
How do I fix CVE-2025-22273?
To fix CVE-2025-22273, implement rate limiting on user interaction requests at the /EPMUI/VfManager.asmx/ChangePassword endpoint.
Which software is affected by CVE-2025-22273?
CVE-2025-22273 affects CyberArk Endpoint Privilege Manager.
What type of attack does CVE-2025-22273 allow?
CVE-2025-22273 allows attackers to conduct brute force password attacks due to a lack of limitations on request frequency.
Is there a known workaround for CVE-2025-22273?
Currently, there are no specific workarounds for CVE-2025-22273, but applying security best practices for password management is recommended.