CVE-2021-37151

{"containers": {"cna": {"affected": [{"product": "Identity", "vendor": "CyberArk", "versions": [{"status": "affected", "version": "21.5.131"}]}], "descriptions": [{"lang": "en", "value": "CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords."}], "problemTypes": [{"descriptions": [{"description": "Username Enumeration Vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-09-02T13:24:35.000Z", "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cyberark.com/products/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.gov.il/en/departments/faq/cve_advisories"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@cyber.gov.il", "ID": "CVE-2021-37151", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Identity", "version": {"version_data": [{"version_value": "21.5.131"}]}}]}, "vendor_name": "CyberArk"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Username Enumeration Vulnerability"}]}]}, "references": {"reference_data": [{"name": "https://www.cyberark.com/products/", "refsource": "MISC", "url": "https://www.cyberark.com/products/"}, {"name": "https://www.gov.il/en/departments/faq/cve_advisories", "refsource": "MISC", "url": "https://www.gov.il/en/departments/faq/cve_advisories"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:16:02.865Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cyberark.com/products/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.gov.il/en/departments/faq/cve_advisories"}]}]}, "cveMetadata": {"assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "assignerShortName": "INCD", "cveId": "CVE-2021-37151", "datePublished": "2021-09-01T12:35:08.000Z", "dateReserved": "2021-07-21T00:00:00.000Z", "dateUpdated": "2024-08-04T01:16:02.865Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Identity", "vendor": "CyberArk", "versions": [{"status": "affected", "version": "21.5.131"}]}], "source": "cna@cyber.gov.il"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD819936-9C28-43AC-90B8-8447B2B343C2", "versionEndExcluding": "21.11.133", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords."}, {"lang": "es", "value": "CyberArk Identity versi\u00f3n 21.5.131, cuando maneja un intento de autenticaci\u00f3n no v\u00e1lido, a veces revela si el nombre de usuario es v\u00e1lido. En determinadas configuraciones de pol\u00edticas de autenticaci\u00f3n con MFA, la longitud de la respuesta de la API puede ser usada para diferenciar entre un usuario v\u00e1lido y uno no v\u00e1lido (tambi\u00e9n se conoce como Enumeraci\u00f3n de Nombres de Usuario). La diferenciaci\u00f3n de la respuesta permite a atacantes enumerar los nombres de usuario de los usuarios v\u00e1lidos de la aplicaci\u00f3n. Los atacantes pueden usar esta informaci\u00f3n para aprovechar los ataques de fuerza bruta y de diccionario con el fin de detectar informaci\u00f3n v\u00e1lida de la cuenta, como las contrase\u00f1as"}], "id": "CVE-2021-37151", "lastModified": "2026-06-17T04:00:09.027", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-09-01T13:15:08.367", "references": [{"source": "cna@cyber.gov.il", "url": "https://www.cyberark.com/products/"}, {"source": "cna@cyber.gov.il", "url": "https://www.gov.il/en/departments/faq/cve_advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.cyberark.com/products/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.gov.il/en/departments/faq/cve_advisories"}], "sourceIdentifier": "cna@cyber.gov.il", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}