CVE-2020-25594

Name
CVE-2020-25594
Description
HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* vault >= None < 1.5.7
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* vault >= 1.6.0 < 1.6.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status