CyberArk Endpoint Privilege Manager Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in CyberArk Endpoint Privilege Manager SaaS version 24.7.1. The issue arises in the '/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg' endpoint, where code can be injected into the 'modalDlgMsgInternal' parameter via POST requests. This injected code is executed in the browser. However, exploiting this vulnerability requires bypassing the Content-Security-Policy, which normally restricts JavaScript execution but allows HTML injection.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected code is executed in the context of the user's browser.