PT-2020-14842 · Hashicorp · Vault Enterprise+1

Published 2020-08-26 · Updated 2025-06-21 · CVE-2020-16250

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer

Description The issue concerns an authentication bypass when HashiCorp Vault and Vault Enterprise are configured with the AWS IAM auth method. This could potentially allow unauthorized access. The estimated number of affected devices is not specified.

Recommendations For versions 0.7.1 and newer, update to version 1.2.5, 1.3.8, 1.4.4, or 1.5.1 to resolve the issue. As a temporary workaround, consider restricting the use of the AWS IAM auth method until a patch is applied.

Fix

Authentication Bypass by Spoofing

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-290

CWE-345

Related Identifiers

BIT-VAULT-2020-16250

CVE-2020-16250

GHSA-FP52-QW33-MFMW

GO-2022-0825

Affected Products

Hashicorp Vault

Vault Enterprise

References · 13

• https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16250 · Vendor Advisory
• https://hashicorp.com/blog/category/vault · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16250 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2020-16250 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fp52-qw33-mfmw · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0825 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html · Note
• https://github.com/advisories/GHSA-fp52-qw33-mfmw · Note
• https://t.me/cvenotify/57551 · Telegram Post
• https://t.me/secharvester/19403 · Telegram Post
• https://t.me/cybersecuritytechnologies/1870 · Telegram Post