CVE-2025-22271

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22271", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-01-02T13:12:19.641Z", "datePublished": "2025-02-28T12:32:55.955Z", "dateUpdated": "2025-03-05T15:49:31.652Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "platforms": ["SaaS"], "product": "Endpoint Privilege Manager", "vendor": "CyberArk", "versions": [{"status": "affected", "version": "24.7.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Karol Mazurek (Afine Team)"}, {"lang": "en", "type": "finder", "value": "Maksymilian Kubiak (Afine Team)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The application or its infrastructure allows for IP address spoofing by providing its own value in the \"X-Forwarded-For\" header. Thus, the action logging mechanism in the application loses&nbsp;accountability<br></p><p>This issue affects&nbsp;CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown.&nbsp;After multiple attempts to contact the vendor we did not receive any answer.</p>"}], "value": "The application or its infrastructure allows for IP address spoofing by providing its own value in the \"X-Forwarded-For\" header. Thus, the action logging mechanism in the application loses\u00a0accountability\n\n\nThis issue affects\u00a0CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown.\u00a0After multiple attempts to contact the vendor we did not receive any answer."}], "impacts": [{"capecId": "CAPEC-151", "descriptions": [{"lang": "en", "value": "CAPEC-151 Identity Spoofing"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2025-03-05T15:49:31.652Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2025/02/CVE-2025-22270/"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2025/02/CVE-2025-22270/"}, {"tags": ["product"], "url": "https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm"}], "source": {"discovery": "UNKNOWN"}, "tags": ["exclusively-hosted-service"], "title": "IP Spoofing in CyberArk Endpoint Privilege Manager", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-28T13:05:53.982814Z", "id": "CVE-2025-22271", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T13:06:10.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22271", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-28T13:05:53.982814Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T13:06:06.326Z"}}], "cna": {"tags": ["exclusively-hosted-service"], "title": "IP Spoofing in CyberArk Endpoint Privilege Manager", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Karol Mazurek (Afine Team)"}, {"lang": "en", "type": "finder", "value": "Maksymilian Kubiak (Afine Team)"}], "impacts": [{"capecId": "CAPEC-151", "descriptions": [{"lang": "en", "value": "CAPEC-151 Identity Spoofing"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CyberArk", "product": "Endpoint Privilege Manager", "versions": [{"status": "affected", "version": "24.7.1"}], "platforms": ["SaaS"], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/en/posts/2025/02/CVE-2025-22270/", "tags": ["third-party-advisory"]}, {"url": "https://cert.pl/posts/2025/02/CVE-2025-22270/", "tags": ["third-party-advisory"]}, {"url": "https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The application or its infrastructure allows for IP address spoofing by providing its own value in the \"X-Forwarded-For\" header. Thus, the action logging mechanism in the application loses\u00a0accountability\n\n\nThis issue affects\u00a0CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown.\u00a0After multiple attempts to contact the vendor we did not receive any answer.", "supportingMedia": [{"type": "text/html", "value": "<p>The application or its infrastructure allows for IP address spoofing by providing its own value in the \"X-Forwarded-For\" header. Thus, the action logging mechanism in the application loses&nbsp;accountability<br></p><p>This issue affects&nbsp;CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown.&nbsp;After multiple attempts to contact the vendor we did not receive any answer.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2025-03-05T15:49:31.652Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22271", "state": "PUBLISHED", "dateUpdated": "2025-03-05T15:49:31.652Z", "dateReserved": "2025-01-02T13:12:19.641Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2025-02-28T12:32:55.955Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["SaaS"], "product": "Endpoint Privilege Manager", "vendor": "CyberArk", "versions": [{"status": "affected", "version": "24.7.1"}]}], "source": "cvd@cert.pl"}], "cveTags": [{"sourceIdentifier": "cvd@cert.pl", "tags": ["exclusively-hosted-service"]}], "descriptions": [{"lang": "en", "value": "The application or its infrastructure allows for IP address spoofing by providing its own value in the \"X-Forwarded-For\" header. Thus, the action logging mechanism in the application loses\u00a0accountability\n\n\nThis issue affects\u00a0CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown.\u00a0After multiple attempts to contact the vendor we did not receive any answer."}, {"lang": "es", "value": "La aplicaci\u00f3n o su infraestructura permiten la suplantaci\u00f3n de direcciones IP al proporcionar su propio valor en el encabezado \"X-Forwarded-For\". Por lo tanto, el mecanismo de registro de acciones de la aplicaci\u00f3n pierde la responsabilidad. Este problema afecta a CyberArk Endpoint Privilege Manager en la versi\u00f3n SaaS 24.7.1. Se desconoce el estado de otras versiones. Despu\u00e9s de varios intentos de comunicarnos con el proveedor, no recibimos ninguna respuesta."}], "id": "CVE-2025-22271", "lastModified": "2026-06-17T08:46:03.097", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22271", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-28T13:05:53.982814Z", "version": "2.0.3"}}]}, "published": "2025-02-28T13:15:27.630", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2025/02/CVE-2025-22270/"}, {"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2025/02/CVE-2025-22270/"}, {"source": "cvd@cert.pl", "url": "https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"created": "2025-07-12T15:26:20.653499+00:00", "updated": "2025-07-12T15:26:20.653599+00:00", "vendors": ["cyberark", "cyberark$PRODUCT$endpoint_privilege_manager"]}