GCVE - cpe:2.3:a:cyberark:conjur:13.6:*:*:*:enterprise:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cyberark:conjur:13.6:*:*:*:enterprise:*:*:*

part: a version: 13.6 update: *

Vendor	Cyberark (`9c54839f-9986-5c3d-9a93-34ddd2d9eb95`)
Product	Conjur (`fce9ac9b-ae40-55b4-b3ad-a7683fc80688`)
Edition	*
Language	*
Software edition	enterprise
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/cyberark/conjur`	purl2cpe	2026-06-01 10:16:42.273221

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-49831`	vulnerable	2026-06-03 15:01:46.123885	Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberArk believes there to be very few installations where this issue can be actively exploited, though Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1 may be affected. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue. Published: 2025-07-15T20:10:35.367Z Updated: 2025-11-04T21:11:31.855Z Open on db.gcve.eu Reference links https://github.com/cyberark/conjur/security/advisories/GHSA-952q-mjrf-wp5j https://github.com/cyberark/conjur/releases/tag/v1.22.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-49830`	vulnerable	2026-06-03 15:01:46.123163	Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand the folder structure of the Secrets Manager/Conjur server or to have the yaml parser include files on the server in the yaml that is processed as the policy loads. This issue affects Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue. Published: 2025-07-15T20:04:13.380Z Updated: 2025-11-04T21:11:29.226Z Open on db.gcve.eu Reference links https://github.com/cyberark/conjur/security/advisories/GHSA-7m6h-fqrm-m9c5 https://github.com/cyberark/conjur/releases/tag/v1.22.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-49829`	vulnerable	2026-06-03 15:01:46.122334	Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue. Published: 2025-07-15T19:47:59.612Z Updated: 2025-11-04T21:11:26.614Z Open on db.gcve.eu Reference links https://github.com/cyberark/conjur/security/advisories/GHSA-9w76-m74g-4c2r https://github.com/cyberark/conjur/releases/tag/v1.22.1	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.