CVE Vulnerability

CVE-2021-37151

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cyberark.com/products/ Product Vendor Advisory
https://www.gov.il/en/departments/faq/cve_advisories Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*
Information

Published : 2021-09-01 01:15

Updated : 2022-07-12 05:42

NVD link : CVE-2021-37151

Mitre link : CVE-2021-37151

Products Affected
No products.
CWE
CWE-203