BIT-vault-2020-10660

vendorUSosv

view advisory published 2024-03-06Licence: per source

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-10660US	medium5.3OT elevated	0.76% (55th)	—	2020-03-23
HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no lon…

references

External citations — patches, advisories, analysis.

https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-10660WEB
https://www.hashicorp.com/blog/category/vault/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan