Vulnerability Details CVE-2020-16250
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 76.0%
CVSS Severity
CVSS v3 Score 8.2
CVSS v2 Score 7.5
References
- http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151
- https://www.hashicorp.com/blog/category/vault/
- http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151
- https://www.hashicorp.com/blog/category/vault/
Products affected by CVE-2020-16250
-
cpe:2.3:a:hashicorp:vault:0.10.0
-
cpe:2.3:a:hashicorp:vault:0.11.0
-
cpe:2.3:a:hashicorp:vault:0.9.2
-
cpe:2.3:a:hashicorp:vault:1.0.0
-
cpe:2.3:a:hashicorp:vault:1.0.1
-
cpe:2.3:a:hashicorp:vault:1.0.2
-
cpe:2.3:a:hashicorp:vault:1.0.3
-
cpe:2.3:a:hashicorp:vault:1.1.0
-
cpe:2.3:a:hashicorp:vault:1.1.1
-
cpe:2.3:a:hashicorp:vault:1.1.2
-
cpe:2.3:a:hashicorp:vault:1.1.3
-
cpe:2.3:a:hashicorp:vault:1.1.4
-
cpe:2.3:a:hashicorp:vault:1.1.5
-
cpe:2.3:a:hashicorp:vault:1.2.0
-
cpe:2.3:a:hashicorp:vault:1.2.1
-
cpe:2.3:a:hashicorp:vault:1.2.2
-
cpe:2.3:a:hashicorp:vault:1.2.3
-
cpe:2.3:a:hashicorp:vault:1.2.4
-
cpe:2.3:a:hashicorp:vault:1.3.0
-
cpe:2.3:a:hashicorp:vault:1.3.1
-
cpe:2.3:a:hashicorp:vault:1.3.2
-
cpe:2.3:a:hashicorp:vault:1.3.3
-
cpe:2.3:a:hashicorp:vault:1.3.4
-
cpe:2.3:a:hashicorp:vault:1.3.5
-
cpe:2.3:a:hashicorp:vault:1.3.6
-
cpe:2.3:a:hashicorp:vault:1.4.0
-
cpe:2.3:a:hashicorp:vault:1.4.1
-
cpe:2.3:a:hashicorp:vault:1.4.2
-
cpe:2.3:a:hashicorp:vault:1.4.3
-
cpe:2.3:a:hashicorp:vault:1.5.0