Potential Privilege Escalation in CyberArk's Password Vault Web Access
CVE-2024-57967

4.2MEDIUM

Key Information:

Vendor

Cyberark

Status
Privileged Access Manager
Vendor
CVE Published:
3 February 2025

What is CVE-2024-57967?

The Password Vault Web Access (PVWA) component of CyberArk's Privileged Access Manager Self-Hosted, prior to version 14.4, contains a vulnerability that may allow attackers with access to perform LDAP mapping to gain elevated privileges. This security flaw could potentially enable unauthorized actions by leveraging improperly configured access controls within the system. Organizations using affected versions are urged to update to the latest release to mitigate this risk.

Affected Version(s)

Privileged Access Manager 0 < 14.4

References

https://docs.cyberark.com/pam-self-hosted/latest/en/conte...
https://www.cyberark.com/ca24-15/

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.