AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-m979-w9wj-qfj9

HashiCorp Vault Improper Privilege Management

Vault

CVE-2020-10660 · Published Jan 30, 2024 · updated Sep 16, 2024

Medium5.3
Fix: upgrade to 1.3.4 or later
GitHub advisory

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 0.9.0, < 1.3.41.3.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-269
Also known as
BIT-vault-2020-10660, CVE-2020-10660, GO-2024-2486

More Vault advisories

All Vault
High 8.1Mar 4, 2024Incorrect TLS certificate auth method in VaultCVE-2024-2048fixed in 1.14.10 +1Medium 4.5Feb 1, 2024Hashicorp Vault may expose sensitive log informationCVE-2024-0831fixed in 1.15.5High 7.5Jan 31, 2024Improper Authentication in HashiCorp VaultCVE-2021-3282fixed in 1.6.2Medium 6.5Jan 31, 2024Enumeration of users in HashiCorp VaultCVE-2020-35177fixed in 1.5.6 +1High 8.2Jan 31, 2024HashiCorp Vault Authentication bypassCVE-2020-16251fixed in 1.2.5 +3Critical 9.1Jan 30, 2024HashiCorp Vault Improper Privilege ManagementCVE-2020-10661fixed in 1.3.4