CVE-2025-22271 - IP Spoofing in CyberArk Endpoint Privilege Manager

Back Back to CVE browser

MEDIUM

IP Spoofing in CyberArk Endpoint Privilege Manager

Published Feb 28, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.43%

Description

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability

This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Affected products

Vendor CyberArk Product Endpoint Privilege Manager Default
n/a
- Version
  24.7.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

CyberArk

Endpoint Privilege Manager

n/a

Version	Status	Constraints
24.7.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-290

Authentication Bypass by Spoofing

References (4)

https://cert.pl/en/posts/2025/02/CVE-2025-22270/
third-party-advisory
https://cert.pl/posts/2025/02/CVE-2025-22270/
third-party-advisory
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-5966
Advisory

Link	Providers	Tags
https://cert.pl/en/posts/2025/02/CVE-2025-22270/		third-party-advisory
https://cert.pl/posts/2025/02/CVE-2025-22270/		third-party-advisory
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-5966		Advisory