GitHub Advisoryadvisory · Go
GHSA-rpgp-9hmg-j25x Enumeration of users in HashiCorp Vault
MEDIUM
Official page ↗
- Aliases
- CVE-2020-35177
- Ecosystem
- Go
- Packages
- github.com/hashicorp/vault
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R
- Weaknesses
- CWE-200
- Reviewed
- 2024-01-31
Affected packages
• Go github.com/hashicorp/vault: >= 1.5.0, < 1.5.6 → fixed in 1.5.6
• Go github.com/hashicorp/vault: >= 1.6.0, < 1.6.1 → fixed in 1.6.1
Description
HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
Related
Alias · CVE (1)
- CVE-2020-35177 HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness