CVE-2025-22271 - CVE House
Back to Database
Status published Medium CVE-2025-22271

IP Spoofing in CyberArk Endpoint Privilege Manager

Vulnerability Description

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22271

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Karol Mazurek (Afine Team)
  • Maksymilian Kubiak (Afine Team)

References

More from CyberArk

View All →
CVE-2025-46382
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor...
Medium 5.3
CVE-2025-22274
HTML injection in CyberArk Endpoint Privilege Manager
Low 2
CVE-2025-22273
Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
Critical 9.3
CVE-2025-22272
Self Reflected XSS in CyberArk Endpoint Privilege Manager
Low 2.1
CVE-2025-22270
Stored XSS in CyberArk Endpoint Privilege Manager
High 7.3

Affected Vendor

Affected Software

Endpoint Privilege Manager
Vulnerable Versions:
24.7.1

Timeline

Official Publish: February 28th, 2025
Last Modified: March 5th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-290

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Collection
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access