PT-2021-11163 · Hashicorp · Vault Enterprise+1

Published 2021-02-01 · Updated 2024-03-06 · CVE-2020-25594

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.5.7 HashiCorp Vault and Vault Enterprise versions prior to 1.6.2

Description: The issue allows for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests.

Recommendations: For versions prior to 1.5.7, update to version 1.5.7 or later. For versions prior to 1.6.2, update to version 1.6.2 or later.

Fix

Related Identifiers

BIT-VAULT-2020-25594

CVE-2020-25594

Affected Products

Hashicorp Vault

Vault Enterprise

References · 8

• https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336 · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25594 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2020-25594 · Vendor Advisory
• https://t.me/cibsecurity/22896 · Telegram Post
• https://t.me/cvenotify/36164 · Telegram Post
• https://t.me/cvenotify/34122 · Telegram Post