PT-2020-16224 · Hashicorp · Vault Enterprise+1

Published 2020-09-30 · Updated 2024-06-28 · CVE-2020-25816

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions 1.0 through 1.5.3

Description The issue allows leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. This is related to incorrect access control.

Recommendations For HashiCorp Vault and Vault Enterprise versions 1.0 through 1.4.6, update to version 1.4.7. For HashiCorp Vault and Vault Enterprise versions 1.5.0 through 1.5.3, update to version 1.5.4.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BIT-VAULT-2020-25816

CVE-2020-25816

GHSA-57GG-CJ55-Q5G2

GO-2024-2514

Affected Products

Hashicorp Vault

Vault Enterprise

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2020-25816 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25816 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-57gg-cj55-q5g2 · Vendor Advisory
• https://hashicorp.com/blog/category/vault · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2020-25816 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2514 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154 · Note
• https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#147 · Note
• https://github.com/hashicorp/vault/pull/10020/commits/f192878110fe93eb13da914b2bee28caa7866a29 · Note
• https://t.me/cibsecurity/14973 · Telegram Post
• https://github.com/advisories/GHSA-57gg-cj55-q5g2 · Note