CVE-2020-16251 — Improper Authentication in Hashicorp Vault

CWE-287 — Improper Authentication6 documents5 sources
Severity
8.2HIGHNVD
EPSS
0.9%
top 23.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Hashicorp VaultHashicorp Vault
Timeline
PublishedAug 26
Latest updateJun 28

Description

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NExploitability: 3.9 | Impact: 4.2

Affected Packages2 packages

▶NVDhashicorp/vault0.8.3 — 1.2.5+3
▶Gogithub.com/hashicorp_vault0.8.3 — 1.2.5+3

🔴Vulnerability Details

3
OSV
HashiCorp Vault Authentication bypass in github.com/hashicorp/vault↗2024-06-28
▶
GHSA
HashiCorp Vault Authentication bypass↗2024-01-31
▶
OSV
HashiCorp Vault Authentication bypass↗2024-01-31
▶

📋Vendor Advisories

1
Red Hat
vault: GCP Auth Method Allows Authentication Bypass↗2020-08-26
▶