PT-2025-47785 · Hashicorp · Vault Terraform Provider

CVE-2025-13357 · Publicado 2025-11-21 · Atualizado 2025-12-15

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vault Terraform Provider versions prior to 5.5.0

Description The Vault Terraform Provider was configured with an insecure default setting for the LDAP auth method. Specifically, the deny null bind parameter defaulted to false, which could allow authentication bypass if the LDAP server permitted anonymous or unauthenticated binds. This could potentially lead to unauthorized access.

Recommendations Update to Vault Terraform Provider version 5.5.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2025-13357

GHSA-GMM6-J2G5-R52M

GO-2025-4152

SUSE-SU-2025:4395-1

Produtos afetados

Vault Terraform Provider

Referências · 56

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13357.json · Exploit
• https://github.com/hashicorp/terraform-provider-vault · Nota
• https://github.com/hashicorp/terraform-provider-vault/releases/tag/v5.5.0 · Nota
• https://github.com/hashicorp/terraform-provider-vault/commit/882bc7f409acc99c872c345edd65159d9568589a · Nota
• https://github.com/hashicorp/terraform-provider-vault/pull/2622 · Nota
• https://suse.com/security/cve/CVE-2025-66411 · Nota
• https://suse.com/security/cve/CVE-2025-65111 · Nota
• https://suse.com/security/cve/CVE-2025-65025 · Nota
• https://suse.com/security/cve/CVE-2025-65026 · Nota
• https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-41115 · Nota
• https://suse.com/security/cve/CVE-2025-64443 · Nota
• https://suse.com/security/cve/CVE-2017-18877 · Nota
• https://osv.dev/vulnerability/GO-2025-4152 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-66506 · Nota