A
n inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically have enough information that the number of possible keys (for a credential file) is only one, and the number is usually not higher than 2^36.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.html | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2021/Sep/1 | Mailing List Third Party Advisory |
| https://korelogic.com/Resources/Advisories/KL-001-2021-008.txt | Mailing List Third Party Advisory |
| https://www.cyberark.com/resources/blog | Product |
| http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.html | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2021/Sep/1 | Mailing List Third Party Advisory |
| https://korelogic.com/Resources/Advisories/KL-001-2021-008.txt | Mailing List Third Party Advisory |
| https://www.cyberark.com/resources/blog | Product |
Configurations
History
21 Nov 2024, 06:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.html - Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2021/Sep/1 - Mailing List, Third Party Advisory | |
| References | () https://korelogic.com/Resources/Advisories/KL-001-2021-008.txt - Mailing List, Third Party Advisory | |
| References | () https://www.cyberark.com/resources/blog - Product |
Information
Published : 2021-09-02 01:15
Updated : 2024-11-21 06:06
NVD link : CVE-2021-31796
Mitre link : CVE-2021-31796
CVE.ORG link : CVE-2021-31796
JSON object : View
Products Affected
CWE
CWE-327
Use of a Broken or Risky Cryptographic Algorithm