Medium severity · published Jan 30, 2025
CVE-2025-24502
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client…
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Symantec Privileged Access Management · Broadcom
3.4.6; 4.1.0 through 4.1.8; 4.2.0 · source: vendor
Affected product
SP
Symantec Privileged Access Management
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24502
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24502
support.broadcom.com
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
More from Symantec Privileged Access Management
9.4
CVE-2024-38492
Symantec Privileged Access Manager Remote Command Execution vulnerability
9.4
CVE-2024-36456
Symantec Privileged Access Manager Remote Command Execution vulnerability
9.4
CVE-2024-36455
Symantec Privileged Access Manager Remote Command Execution vulnerability
9.3
CVE-2025-24503
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server
8.9
CVE-2025-24507
This vulnerability allows appliance compromise at boot time