Read the docs
TI-2021-15217 Aliases CVE-2021-37151GHSA-rq35-f9g6-4534

Observable discrepancy in CyberArk Identity

Priority LOW 26CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-203.

Summary

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.

Why it matters now

EPSS 0.00854 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CyberArkIdentity21.5.131—No fix listedCNA
  • Identity VendorCyberArk Affected 21.5.131 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*before 21.11.133VulnerableCyberArk
  • cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:* Versions before 21.11.133 Vulnerable ·CyberArk

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37151
  2. 2026-10-03 Alias added: GHSA-rq35-f9g6-4534

References

Other 2

  • TI-2024-28327 CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security CVSS 3.1HIGH 8.3
  • TI-2024-28324 CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS 3.1MEDIUM 6.5
  • TI-2022-06953 CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication'… CVSS 3.1MEDIUM 5.3
  • TI-2024-28326 CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS 3.1MEDIUM 4.3
  • TI-2024-28325 CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences