The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Cyberark Password Vault | — | Upgrade to version 9.9.5 of CyberArk Password Vault Web AccessUpgrade to version 9.10.1 of CyberArk Password Vault Web AccessUpgrade to the latest version of CyberArk Password Vault Web AccessUpgrade to version 10.1 of CyberArk Password Vault Web Access | Apr 16, 2018 | Apr 9, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
