BIT-vault-2020-16251

vendorUSosv

view advisory published 2024-03-06Licence: per source

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-16251US	high8.2	2.83% (87th)	—	2020-08-26
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.…

references

External citations — patches, advisories, analysis.

http://packetstormsecurity.com/files/159479/Hashicorp-Vault-GCP-IAM-Integration-Authentication-Bypass.htmlADVISORY
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-16251WEB
https://www.hashicorp.com/blog/category/vault/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan