What is the CVSS score of CVE-2020-25374?

CVE-2020-25374 has a CVSS 3.1 base score of 2.6 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.6%.

Privileged Session Manager CVE-2020-25374

LOW

Insufficient Session Expiration (CWE-613)

2020-10-28 cve@mitre.org

Information Disclosure Privileged Session Manager

2.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.6 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Oct 28, 2020 - 20:15 nvd

LOW 2.6

DescriptionNVD

CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.

AnalysisAI

CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-613. CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time. Affected products include: Cyberark Privileged Session Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.