CVE-2021-37151

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.cyberark.com/products/
https://www.gov.il/en/departments/faq/cve_advisories

Configurations

Configuration 1 (hide)

cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*

History

07 Nov 2023, 03:36

Type	Values Removed	Values Added
References	~~(MISC) https://www.gov.il/en/departments/faq/cve_advisories - Third Party Advisory~~	() https://www.gov.il/en/departments/faq/cve_advisories -
References	~~(MISC) https://www.cyberark.com/products/ - Product, Vendor Advisory~~	() https://www.cyberark.com/products/ -

Information

Published : 2021-09-01 13:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-37151

Mitre link : CVE-2021-37151

CVE.ORG link : CVE-2021-37151

JSON object : View

Products Affected

cyberark

identity

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2021-37151", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-09-01T13:15:08.367", "references": [{"url": "https://www.cyberark.com/products/", "source": "cna@cyber.gov.il"}, {"url": "https://www.gov.il/en/departments/faq/cve_advisories", "source": "cna@cyber.gov.il"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords."}, {"lang": "es", "value": "CyberArk Identity versi\u00f3n 21.5.131, cuando maneja un intento de autenticaci\u00f3n no v\u00e1lido, a veces revela si el nombre de usuario es v\u00e1lido. En determinadas configuraciones de pol\u00edticas de autenticaci\u00f3n con MFA, la longitud de la respuesta de la API puede ser usada para diferenciar entre un usuario v\u00e1lido y uno no v\u00e1lido (tambi\u00e9n se conoce como Enumeraci\u00f3n de Nombres de Usuario). La diferenciaci\u00f3n de la respuesta permite a atacantes enumerar los nombres de usuario de los usuarios v\u00e1lidos de la aplicaci\u00f3n. Los atacantes pueden usar esta informaci\u00f3n para aprovechar los ataques de fuerza bruta y de diccionario con el fin de detectar informaci\u00f3n v\u00e1lida de la cuenta, como las contrase\u00f1as"}], "lastModified": "2023-11-07T03:36:54.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD819936-9C28-43AC-90B8-8447B2B343C2", "versionEndExcluding": "21.11.133"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cyber.gov.il"}