What is CVE-2021-37151?

CVE-2021-37151 is a medium-severity vulnerability in Cyberark Identity, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2021-09-01.

How severe is CVE-2021-37151?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Cyberark Identity

CVE-2021-37151

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.

EPSS: 0.009 (54.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Cyberark Identity — versions 21.5.131

Weakness classification (CWE)

CWE-203 — Observable Discrepancy

References

cna@cyber.gov.il (x_refsource_MISC)
cna@cyber.gov.il (x_refsource_MISC)

Frequently asked questions

What is CVE-2021-37151?: CVE-2021-37151 is a medium-severity vulnerability in Cyberark Identity, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2021-09-01.
How severe is CVE-2021-37151?: Medium severity. CVSS v3 base score is 5.3 out of 10.