CyberArk Endpoint Privilege Manager IP Address Spoofing Vulnerability

A vulnerability in CyberArk Endpoint Privilege Manager SaaS version 24.7.1 allows for IP address spoofing by manually setting values in the 'X-Forwarded-For' header. This manipulation disrupts the application's action logging, leading to a loss of accountability. The vulnerability's exploitation could be mitigated by an additional error that bypasses the Content-Security-Policy, which normally restricts JavaScript execution but still permits HTML injection.

Impact

Exploitation of this vulnerability could result in unauthorized IP address spoofing, causing the application's logging mechanism to fail in accurately recording actions, thereby undermining accountability.