CVE-2021-37151

Name of the Vulnerable Software and Affected Versions CyberArk Identity version 21.5.131

Description The issue allows attackers to differentiate between valid and invalid users through response length, enabling username enumeration. This can be used to leverage brute-force and dictionary attacks to discover valid account information such as passwords.

Recommendations For CyberArk Identity version 21.5.131, consider restricting access to the authentication API until a patch is available, and review authentication policy configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.