CVE-2021-31796
HIGH 7.5EPSS 1.8%
An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically have enough information that the number of possible keys (for a credential file) is only one, and the number is usually not higher than 2^36.
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 1.76% chance of exploitation in the next 30 days, 78th percentile
- Published
- 2021-09-02
- Updated
- 2024-08-03
Proof-of-concept exploits (1)
- unmanarc/CACredDecoder1★ · 2021-10-11
Security advisories
- http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effecti…
- http://seclists.org/fulldisclosure/2021/Sep/1
- https://korelogic.com/Resources/Advisories/KL-001-2021-008.txt
- https://www.cyberark.com/resources/blog