CVE-2020-35177

Medium

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

mitre·CWE-209·Published 2020-12-17

CVSS

5.3

EPSS

0.01

KEV

Exploits

cve.orgen

137 chars

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

NVDen

137 chars

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

OSV.deven

69 chars

Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault

GHSAen

121 chars

HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

NVDes

176 chars

HashiCorp Vault y Vault Enterprise 1.4.1 y más recientes permitieron la enumeración de usuarios por medio del método de autenticación LDAP. Corregido en versiones 1.5.6 y 1.6.1

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.0	10.0	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
3.1	Primary	NVD	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N