Stored XSS in CyberArk Endpoint Privilege Manager

An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

CyberArk Endpoint Privilege Manager 安全漏洞

CyberArk Endpoint Privilege Manager是以色列CyberArk公司的一款权限管理软件。该软件包括权限管理、应用程序控制和凭证丢失保护等功能。 CyberArk Endpoint Privilege Manager 24.7.1版本存在安全漏洞，该漏洞源于角色管理中的name字段允许代码注入。

N/A

N/A