CVE-2021-31796

An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically have enough information that the number of possible keys (for a credential file) is only one, and the number is usually not higher than 2^36.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.76% chance of exploitation in the next 30 days, 76th percentile

Published

2021-09-02

Updated

2024-08-03

Proof-of-concept exploits (1)

• unmanarc/CACredDecoder1★ · 2021-10-11

References

• CVE Record
• NVD entry

Related

• CVE-2014-4210
• CVE-2014-4241
• CVE-2021-31795
• CVE-2021-31799
• CVE-2021-31777
• CVE-2021-31800