CVE-2018-12903

PoC —

CVSS 3.0

5.4 medium

EPSS

<1%p49

Published

Jun 26, 2018 (Jun 26, 2018)

Modified

Jun 17, 2026

Description

In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts->DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application Group Wizard.

Vendors: cyberark
Products: endpoint privilege manager
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.