An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically have enough information that the number of possible keys (for a credential file) is only one, and the number is usually not higher than 2^36.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.html | Third Party Advisory VDB Entry |
http://seclists.org/fulldisclosure/2021/Sep/1 | Mailing List Third Party Advisory |
https://korelogic.com/Resources/Advisories/KL-001-2021-008.txt | Mailing List Third Party Advisory |
https://www.cyberark.com/resources/blog | Product |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2021-09-02T00:24:16
Updated: 2021-09-02T16:06:17
Reserved: 2021-04-25T00:00:00
Link: CVE-2021-31796
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-09-02T01:15:06.400
Modified: 2022-07-12T17:42:04.277
Link: CVE-2021-31796
JSON object: View
Redhat Information
No data.
CWE