CVE-2024-54840 - PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection

Back Back to CVE browser

MEDIUM

PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection

Published Feb 3, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.16%

Description

PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection.

Affected products

Vendor CyberArk Product Privileged Access Manager Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <14.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

CyberArk

Privileged Access Manager

unaffected

Version	Status	Constraints
0	affected	<14.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-348

References (3)

https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-4.htm#Securitybugfixes
Release Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52678
Advisory
https://gist.github.com/Hurdano/8244855ef8ec364fd98a2693de6e30c5
Third Party Advisory

Link	Providers	Tags
https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-4.htm#Securitybugfixes		Release Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52678		Advisory
https://gist.github.com/Hurdano/8244855ef8ec364fd98a2693de6e30c5		Third Party Advisory