CVE-2025-22273CWE-770

Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager

Critical · published February 28, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use.

This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00617 · 48.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-02-28T12:33Z
EPSS history
Timeline
  • 28 FEB 12:33Z
    Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
    cvelistv5