Username Enumeration Vulnerability in CyberArk Identity

CVE-2021-37151

What is CVE-2021-37151?

An issue in CyberArk Identity version 21.5.131 allows an attacker to ascertain whether a username exists within the application by observing the differences in API response lengths for valid and invalid authentication attempts. This vulnerability can be exploited in specific configurations involving Multi-Factor Authentication (MFA), where response timing can inadvertently provide insights into known usernames. As a result, attackers may leverage this flaw to conduct enumeration attacks, leading to subsequent brute-force or dictionary attacks aimed at compromising user accounts and extracting sensitive information such as passwords.

References