CVE-2021-37151 (GCVE-0-2021-37151)

Vulnerability from cvelistv5 – Published: 2021-09-01 12:35 – Updated: 2024-08-04 01:16
VLAI?
Summary
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.
Severity ?
No CVSS data available.
CWE
  • Username Enumeration Vulnerability
Assigner
References
Impacted products
Vendor Product Version
CyberArk Identity Affected: 21.5.131
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:16:02.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cyberark.com/products/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Identity",
          "vendor": "CyberArk",
          "versions": [
            {
              "status": "affected",
              "version": "21.5.131"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Username Enumeration Vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-02T13:24:35",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cyberark.com/products/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.gov.il/en/departments/faq/cve_advisories"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@cyber.gov.il",
          "ID": "CVE-2021-37151",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Identity",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "21.5.131"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CyberArk"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Username Enumeration Vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cyberark.com/products/",
              "refsource": "MISC",
              "url": "https://www.cyberark.com/products/"
            },
            {
              "name": "https://www.gov.il/en/departments/faq/cve_advisories",
              "refsource": "MISC",
              "url": "https://www.gov.il/en/departments/faq/cve_advisories"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2021-37151",
    "datePublished": "2021-09-01T12:35:08",
    "dateReserved": "2021-07-21T00:00:00",
    "dateUpdated": "2024-08-04T01:16:02.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"21.11.133\", \"matchCriteriaId\": \"BD819936-9C28-43AC-90B8-8447B2B343C2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.\"}, {\"lang\": \"es\", \"value\": \"CyberArk Identity versi\\u00f3n 21.5.131, cuando maneja un intento de autenticaci\\u00f3n no v\\u00e1lido, a veces revela si el nombre de usuario es v\\u00e1lido. En determinadas configuraciones de pol\\u00edticas de autenticaci\\u00f3n con MFA, la longitud de la respuesta de la API puede ser usada para diferenciar entre un usuario v\\u00e1lido y uno no v\\u00e1lido (tambi\\u00e9n se conoce como Enumeraci\\u00f3n de Nombres de Usuario). La diferenciaci\\u00f3n de la respuesta permite a atacantes enumerar los nombres de usuario de los usuarios v\\u00e1lidos de la aplicaci\\u00f3n. Los atacantes pueden usar esta informaci\\u00f3n para aprovechar los ataques de fuerza bruta y de diccionario con el fin de detectar informaci\\u00f3n v\\u00e1lida de la cuenta, como las contrase\\u00f1as\"}]",
      "id": "CVE-2021-37151",
      "lastModified": "2024-11-21T06:14:44.197",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-09-01T13:15:08.367",
      "references": "[{\"url\": \"https://www.cyberark.com/products/\", \"source\": \"cna@cyber.gov.il\"}, {\"url\": \"https://www.gov.il/en/departments/faq/cve_advisories\", \"source\": \"cna@cyber.gov.il\"}, {\"url\": \"https://www.cyberark.com/products/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.gov.il/en/departments/faq/cve_advisories\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cna@cyber.gov.il",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-203\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-37151\",\"sourceIdentifier\":\"cna@cyber.gov.il\",\"published\":\"2021-09-01T13:15:08.367\",\"lastModified\":\"2024-11-21T06:14:44.197\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.\"},{\"lang\":\"es\",\"value\":\"CyberArk Identity versi\u00f3n 21.5.131, cuando maneja un intento de autenticaci\u00f3n no v\u00e1lido, a veces revela si el nombre de usuario es v\u00e1lido. En determinadas configuraciones de pol\u00edticas de autenticaci\u00f3n con MFA, la longitud de la respuesta de la API puede ser usada para diferenciar entre un usuario v\u00e1lido y uno no v\u00e1lido (tambi\u00e9n se conoce como Enumeraci\u00f3n de Nombres de Usuario). La diferenciaci\u00f3n de la respuesta permite a atacantes enumerar los nombres de usuario de los usuarios v\u00e1lidos de la aplicaci\u00f3n. Los atacantes pueden usar esta informaci\u00f3n para aprovechar los ataques de fuerza bruta y de diccionario con el fin de detectar informaci\u00f3n v\u00e1lida de la cuenta, como las contrase\u00f1as\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"21.11.133\",\"matchCriteriaId\":\"BD819936-9C28-43AC-90B8-8447B2B343C2\"}]}]}],\"references\":[{\"url\":\"https://www.cyberark.com/products/\",\"source\":\"cna@cyber.gov.il\"},{\"url\":\"https://www.gov.il/en/departments/faq/cve_advisories\",\"source\":\"cna@cyber.gov.il\"},{\"url\":\"https://www.cyberark.com/products/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.gov.il/en/departments/faq/cve_advisories\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.