PT-2021-21533 · Cyberark · Cyberark Identity

Published 2021-09-01 · Updated 2022-07-12 · CVE-2021-37151

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CyberArk Identity version 21.5.131

Description The issue allows attackers to differentiate between valid and invalid users through response length, enabling username enumeration. This can be used to leverage brute-force and dictionary attacks to discover valid account information such as passwords.

Recommendations For CyberArk Identity version 21.5.131, consider restricting access to the authentication API until a patch is available, and review authentication policy configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2021-37151

Affected Products

Cyberark Identity

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-37151 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37151 · Vendor Advisory
• https://cyberark.com/products · Note
• https://gov.il/en/departments/faq/cve_advisories · Note