CVE-2020-25816

Medium

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because…

mitre·NVD-CWE-noinfo·Published 2020-09-30

CVSS

6.8

EPSS

0.01

KEV

Exploits

cve.orgen

201 chars

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.

NVDen

201 chars

OSV.deven

85 chars

Token leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault

GHSAen

84 chars

HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.

NVDes

275 chars

Las versiones 1.0 y posteriores de HashiCorp Vault y Vault Enterprise permitían que los contratos de arrendamiento creados con un testigo de lote sobrevivieran a su TTL porque el tiempo de caducidad no estaba programado correctamente. Corregido en las versiones 1.4.7 y 1.5.4

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	4.9	6.8	4.9	AV:N/AC:M/Au:S/C:P/I:P/A:N
3.1	Primary	NVD	6.8	1.6	5.2	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N