CVE-2021-37151: cyberark identity Observable Discrepancy

Vulnerability summary

CVE-2021-37151 is a medium (CVSS 5.3) Observable Discrepancy vulnerability in cyberark identity. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.8% of scored vulnerabilities.

Timeline

1. 01-09-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.

• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.