5.3
Medium
CVE-2025-24502 An improper session validation allows an unauthenticated attacker to cause certain request notifications to be…
Description
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Symantec Privileged Access Management | 4.2.0 | No fix stated |
| Symantec Privileged Access Management 4.1 | 4.1.0 → 4.1.8 | No fix stated |
| Symantec Privileged Access Management | 3.4.6 | No fix stated |
Other CVEs of Symantec Privileged Access Management
The 18 CVEs of Symantec Privileged Access Management →
CVE-2025-24507
This vulnerability allows appliance compromise at boot time
8.9
High
CVE-2025-24506
A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types
5.3
Medium
CVE-2025-24505
This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected…
8.8
High
CVE-2025-24504
An improper input validation the CSRF filter results in unsanitized user input written to the application logs
5.3
Medium