VaultGHSA-rpgp-9hmg-j25x
Enumeration of users in HashiCorp Vault
Medium6.5CVE-2020-35177 · Published Jan 31, 2024 · updated Jun 28, 2024
HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.5.0, < 1.5.6 | 1.5.6 |
| >= 1.6.0, < 1.6.1 | 1.6.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-vault-2020-35177, CVE-2020-35177, GO-2024-2508
More Vault advisories
All Vault| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 42024 | Incorrect TLS certificate auth method in Vault High8.1Mar 4, 2024 | High8.1 | 1.14.10+1 more |
| Feb 12024 | Hashicorp Vault may expose sensitive log informationMedium4.5Feb 1, 2024 | Medium4.5 | 1.15.5 |
| Jan 312024 | Improper Authentication in HashiCorp VaultHigh7.5Jan 31, 2024 | High7.5 | 1.6.2 |
| Jan 312024 | HashiCorp Vault Authentication bypassHigh8.2Jan 31, 2024 | High8.2 | 1.2.5+3 more |
| Jan 302024 | HashiCorp Vault Improper Privilege ManagementMedium5.3Jan 30, 2024 | Medium5.3 | 1.3.4 |
| Jan 302024 | HashiCorp Vault Improper Privilege ManagementCritical9.1Jan 30, 2024 | Critical9.1 | 1.3.4 |