Vulnerabilities

TI-2024-28327 CVE-2024-42340 · GHSA-2cfw-r36g-3cp6

CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security

LOW 38

CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00324 Published 2024-08-25 Fixed in Upgrade to latest version CWE-602

TI-2024-28326 CVE-2024-42339 · GHSA-qv23-5f38-5wrx

LOW 20

CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0029 Published 2024-08-25 Fixed in Upgrade to latest version CWE-200

TI-2024-28325 CVE-2024-42338 · GHSA-5h39-j9jr-q3ww

LOW 20

CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0029 Published 2024-08-25 Fixed in Upgrade to latest version CWE-200

TI-2024-28324 CVE-2024-42337 · GHSA-642g-j848-7wh7

LOW 29

CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00309 Published 2024-08-25 Fixed in Upgrade to latest version CWE-200

TI-2022-06953 CVE-2022-22700 · GHSA-8pv4-j9f8-22xr

LOW 26

CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01115 Published 2022-03-03 No fix listed CWE-330

TI-2021-15217 CVE-2021-37151 · GHSA-rq35-f9g6-4534

LOW 26

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00854 Published 2021-09-01 No fix listed CWE-203