Medium severity5.3NVD Advisory· Published Mar 3, 2022· Updated Jun 17, 2026

CVE-2022-22700

Description

CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cyber Ark/Identity
cpe:2.3:a:cyberark:identity:*:*:*:*:*:*:*:*
Range: <=22.1
Cyber Ark/Cyberark Identity Managementcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=22.1

Patches

Vulnerability mechanics

References

fluidattacks.com/advisories/porter/nvdExploitThird Party Advisory
docs.cyberark.com/Product-Doc/OnlineHelp/Idaptive/Latest/en/Content/ReleaseNotes/ReleaseNotes-Latest.htmnvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000