CVE-2018-9843 The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.
CriticalCVSS 9.8
EPSS 16.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cyberark password vault | < 9.9.5 | 9.9.5 |
| cyberark password vault | >= 10.0, < 10.1 | 10.1 |
References
- 20180409 [RT-SA-2017-014] CyberArk Password Vault Web Access Remote Code Execution exploit mailing-list third-party-advisory
- 20180409 [RT-SA-2017-014] CyberArk Password Vault Web Access Remote Code Execution exploit mailing-list third-party-advisory vdb-entry
- 1040675 third-party-advisory vdb-entry
- 44429 exploit third-party-advisory vdb-entry
- www.redteam-pentesting.de exploit third-party-advisory