CVE-2020-25374
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal...
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
- Record
CVE-2020-25374- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:P/I:N/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
CVE List No score
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
- Record
CVE-2020-25374- Updated
- 2026-11-02
EUVDEUVD-2020-18061 No score
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
- Record
EUVD-2020-18061- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v42h-j35f-r8x9 No score
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal...
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
- Record
GHSA-v42h-j35f-r8x9- Weakness
- CWE-613
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25374 is a low vulnerability (CVSS 2.6) in Cyberark Privileged Session Manager, published October 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. No source names a fixed version.
References
docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PAS%20SysReq/System%20Requirements%20-%20PSM.htm
medium.com/%40virajmota38/full-path-disclosure-8a9358e5a867
nvd.nist.gov/vuln/detail/CVE-2020-25374
github.com/advisories/GHSA-v42h-j35f-r8x9