CVE-2022-22700

MEDIUM 5.3CVE-2022-22700 · Published 03/03/2022 · updated 17/06/2026

In short

CVE-2022-22700 is a MEDIUM (CVSS 5.3) vulnerability affecting identity (cyberark).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
identity cyberark	`≤ 22.1`	No fix yet

Description

CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant.

References

docs.cyberark.com/Product-Doc/OnlineHelp/Idaptive/Latest/en/Content/ReleaseNotes/ReleaseNotes-Latest.htm · Release Notes
fluidattacks.com/advisories/porter · Exploit

More vulnerabilities in identity

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free