CVE-2018-12903: Cyberark Endpoint Privilege Manager

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts->DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application Group Wizard.

Affected products

• Cyberark Endpoint Privilege Manager: version 10.2.1.603 only

Published 2018-06-26. Last modified 2026-06-17.