Maksymilian Kubiakowi

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The issue allows an attacker with access to the Administration panel, specifically the "Role Management" tab, to inject code by adding a new role in the `name` field. However, the risk of exploiting this issue is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection. **Recommendations** For version 24.7.1, consider restricting access to the "Role Management" tab in the Administration panel to minimize the risk of exploitation. As a temporary workaround, avoid using the `name` field in the "Role Management" tab until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The issue allows IP address spoofing by providing a custom value in the `X-Forwarded-For` header, which compromises the action logging mechanism's accountability. **Recommendations** For version 24.7.1, consider restricting the use of the `X-Forwarded-For` header until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The issue concerns code injection in the "modalDlgMsgInternal" parameter via POST in the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, which is then executed in the browser. The risk of exploitation is somewhat mitigated by the need to bypass the Content-Security-Policy. **Recommendations** For version 24.7.1, consider restricting access to the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the `modalDlgMsgInternal` parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 **Description** The application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint, it is possible to perform a brute force attack on the current password in use. **Recommendations** For CyberArk Endpoint Privilege Manager in SaaS version 24.7.1, consider implementing rate limiting on the "/EPMUI/VfManager.asmx/ChangePassword" endpoint to prevent brute force attacks until a patch is available. As a temporary workaround, restrict access to this endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CyberArk Endpoint Privilege Manager version 24.7.1 **Description** The issue allows for HTML code injection into the page content through the `content` field in the Application definition page. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For version 24.7.1, consider restricting access to the `content` field in the Application definition page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.