Cyber-Ark Vault CVE-2012-6344 User Enumeration Information Disclosure Vulnerability
BID:62067
Info
Cyber-Ark Vault CVE-2012-6344 User Enumeration Information Disclosure Vulnerability
| Bugtraq ID: | 62067 |
| Class: | Design Error |
| CVE: |
CVE-2012-6344 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 01 2013 12:00AM |
| Updated: | Aug 01 2013 12:00AM |
| Credit: | Moshe Zioni from Comsec Global Consulting |
| Vulnerable: |
Cyber-Ark Software Vault 7.2 Cyber-Ark Software Sensitive Information Management Suite 7.5.30 |
| Not Vulnerable: |
Cyber-Ark Software Vault 7.20.37 Cyber-Ark Software Sensitive Information Management Suite 7.6 |
Discussion
Cyber-Ark Vault CVE-2012-6344 User Enumeration Information Disclosure Vulnerability
Cyber-Ark Vault is prone to an information-disclosure vulnerability.
Successfully exploiting this issue may allow attackers to enumerate the user names on the vault server. Information obtained may aid in further attacks.
Versions prior to Cyber-Ark Vault 7.20.37 are vulnerable.
Cyber-Ark Vault is prone to an information-disclosure vulnerability.
Successfully exploiting this issue may allow attackers to enumerate the user names on the vault server. Information obtained may aid in further attacks.
Versions prior to Cyber-Ark Vault 7.20.37 are vulnerable.
Exploit / POC
Cyber-Ark Vault CVE-2012-6344 User Enumeration Information Disclosure Vulnerability
Attacker can exploit this issue using a browser.
Attacker can exploit this issue using a browser.
Solution / Fix
Cyber-Ark Vault CVE-2012-6344 User Enumeration Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Cyber-Ark Vault CVE-2012-6344 User Enumeration Information Disclosure Vulnerability
References:
References:
- Cyber-Ark Homepage (Cyber-Ark)
- CyberArk User Enumeration - Multiple vulnerabilities (Moshe Zioni)