CVE-2025-22272 Self Reflected XSS in CyberArk Endpoint Privilege Manager

In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the...

CVE-2025-22272

CVE-2025-22272 affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. In the /EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg endpoint, the POST parameter modalDlgMsgInternal can be used to inject code that is executed in the browser; exploitation risk is mitigated by the need to by...