Vulnerability Description
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cyberark | Identity | < 21.11.133 |
Related Weaknesses (CWE)
References
- https://www.cyberark.com/products/
- https://www.gov.il/en/departments/faq/cve_advisories
- https://www.cyberark.com/products/
- https://www.gov.il/en/departments/faq/cve_advisories
FAQ
What is CVE-2021-37151?
CVE-2021-37151 is a vulnerability with a CVSS score of 5.3 (MEDIUM). CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response...
How severe is CVE-2021-37151?
CVE-2021-37151 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-37151?
Check the references section above for vendor advisories and patch information. Affected products include: Cyberark Identity.