CVE-2025-22465 Overview
CVE-2025-22465 is a reflected Cross-Site Scripting (XSS) vulnerability in Ivanti Endpoint Manager (EPM). The flaw affects EPM versions prior to 2024 SU1 and prior to 2022 SU7. A remote unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that the user opens. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation allows attackers to run arbitrary JavaScript in the context of an authenticated EPM user's session, enabling session data theft, UI manipulation, and pivoting into administrative actions on the endpoint management console.
Affected Products
- Ivanti Endpoint Manager 2024 (prior to SU1)
- Ivanti Endpoint Manager 2022 SU1 through SU6
- Ivanti Endpoint Manager 2022 base release
Discovery Timeline
- 2025-04-08 - CVE-2025-22465 published to the National Vulnerability Database
- 2025-04-08 - Ivanti publishes the EPM April 2025 Security Advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22465
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the Ivanti Endpoint Manager web interface. Reflected XSS occurs when user-supplied input from an HTTP request is returned in the server response without proper output encoding. An attacker crafts a URL containing JavaScript payload parameters and delivers it to an EPM user through phishing or another social engineering channel. When the user clicks the link, the EPM server reflects the payload into the rendered page, and the browser executes it in the trusted origin of the EPM console.
The attack requires user interaction, which the advisory characterizes as unlikely in normal workflows. The scope is changed, meaning executed script can affect resources beyond the initially vulnerable component. Confidentiality and integrity impacts are limited to what an EPM session exposes.
Root Cause
The root cause is insufficient sanitization and output encoding of untrusted request parameters inside a server-rendered EPM management page. Ivanti has not disclosed the specific parameter or endpoint. The vulnerability is classified under CWE-79.
Attack Vector
Exploitation is network-based and unauthenticated. The attacker constructs a URL pointing to a vulnerable EPM endpoint with a JavaScript payload embedded in a reflected parameter. The victim, typically an EPM administrator with an active session, must open the link. The injected script runs with the privileges of the victim's browser session against the EPM console, enabling actions such as reading DOM content, exfiltrating tokens, or issuing authenticated requests on the user's behalf.
No verified proof-of-concept code is publicly available. Refer to the Ivanti Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2025-22465
Indicators of Compromise
- HTTP request logs on the EPM server containing URL parameters with <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
- Referrer headers on EPM requests originating from external or untrusted domains, particularly following email-delivered links.
- Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after visiting an EPM URL.
Detection Strategies
- Inspect IIS and application logs on the EPM server for reflected parameter patterns matching common XSS payload signatures.
- Deploy a web application firewall (WAF) rule set that inspects query strings and request bodies for script tags and event-handler attributes targeting the EPM console URI.
- Correlate EPM administrator authentication events with anomalous session activity such as unexpected API calls or configuration changes made shortly after link clicks.
Monitoring Recommendations
- Enable full URI logging on the EPM web front end and forward logs to a SIEM for pattern matching against XSS indicators.
- Monitor endpoint browser telemetry on administrator workstations for script execution against the EPM origin, including console errors and outbound beacons.
- Alert on any EPM administrative action initiated within seconds of a first-time visit to an EPM URL containing encoded HTML metacharacters.
How to Mitigate CVE-2025-22465
Immediate Actions Required
- Upgrade Ivanti Endpoint Manager to version 2024 SU1 or 2022 SU7, or later, per the vendor advisory.
- Restrict access to the EPM management console to trusted management networks and VPN-connected administrators only.
- Instruct EPM administrators to avoid clicking EPM console links received via email, chat, or other external channels until patching is complete.
Patch Information
Ivanti released fixed builds in the EPM April 2025 security update. Administrators must apply EPM 2024 SU1 or EPM 2022 SU7. Details and download links are available in the Ivanti Security Advisory EPM April 2025.
Workarounds
- Limit EPM console reachability through network segmentation and firewall rules that block external access to the management URL.
- Deploy a WAF in front of the EPM console with signatures that block reflected XSS payloads in request parameters.
- Enforce a strict Content Security Policy (CSP) at the reverse proxy layer to reduce the impact of injected inline scripts where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
