GitHub Advisoryadvisory · Go

GHSA-m979-w9wj-qfj9 HashiCorp Vault Improper Privilege Management

MEDIUM Published 2024-01-30 Modified 2024-09-16 Official page ↗
Aliases
CVE-2020-10660
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-269
Reviewed
2024-01-30

Affected packages

• Go github.com/hashicorp/vault: >= 0.9.0, < 1.3.4 → fixed in 1.3.4

Description

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

Related

Alias · CVE (1)

  • CVE-2020-10660 HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References