CVE-2021-31796

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically have enough information that the number of possible keys (for a credential file) is only one, and the number is usually not higher than 2^36.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Sep/1Mailing List, Third Party Advisory
https://korelogic.com/Resources/Advisories/KL-001-2021-008.txtMailing List, Third Party Advisory
https://www.cyberark.com/resources/blogProduct
http://packetstormsecurity.com/files/164023/CyberArk-Credential-File-Insufficient-Effective-Key-Space.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Sep/1Mailing List, Third Party Advisory
https://korelogic.com/Resources/Advisories/KL-001-2021-008.txtMailing List, Third Party Advisory
https://www.cyberark.com/resources/blogProduct

Timeline

Published: Sep 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-317975.1The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading CVE-2021-317984.4The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain condition CVE-2021-317997.0In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a CVE-2021-318009.8Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver i CVE-2021-318028.8NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vu CVE-2021-318036.1cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).CVE-2021-318045.5LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document.CVE-2021-318059.8The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a CVE-2021-318066.5An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service a CVE-2021-318076.5An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of S CVE-2021-318086.5An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service a CVE-2021-31816.5rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with