medium5.3
CVE-2020-25594
HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests.
Impact
HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Vault | before 1.5.7 from 1.6.0 before 1.6.2 |
References
- NVD record
- CVE.org record
- https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336
- https://security.gentoo.org/glsa/202207-01
- https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336
- https://security.gentoo.org/glsa/202207-01