BIT-vault-2020-35453

vendorUSosv

view advisory published 2024-03-06Licence: per source

HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-35453US	medium5.3	0.82% (57th)	—	2020-12-17
HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2020-24-vault-enterprise-s-sentinel-egp-policies-may-impact-parent-or-sibling-namespaces/18983ADVISORY
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161ARTICLE
https://nvd.nist.gov/vuln/detail/CVE-2020-35453WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan