CVE-2018-9843
CyberArk Password Vault Web Access < 9.9.5 / < 9.10 / 10.1 - Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.
La API REST en CyberArk Password Vault Web Access, en versiones anteriores a la 9.9.5 y en versiones 10.x anteriores a la 10.1, permite que atacantes remotos ejecuten código arbitrario mediante un objeto .NET serializado en una cabecera Authorization HTTP.
The CyberArk Password Vault Web Access application uses authentication tokens which consist of serialized .NET objects. By crafting manipulated tokens, attackers are able to gain unauthenticated remote code execution on the web server. Versions prior to 9.9.5, prior to 10.1, and 10.1 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-04-07 CVE Reserved
- 2018-04-09 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2024-10-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
http://www.securitytracker.com/id/1040675 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cyberark Search vendor "Cyberark" | Password Vault Search vendor "Cyberark" for product "Password Vault" | < 9.9.5 Search vendor "Cyberark" for product "Password Vault" and version " < 9.9.5" | - |
Affected
| ||||||
Cyberark Search vendor "Cyberark" | Password Vault Search vendor "Cyberark" for product "Password Vault" | >= 10.0 < 10.1 Search vendor "Cyberark" for product "Password Vault" and version " >= 10.0 < 10.1" | - |
Affected
|