Lucene search

PRIOn knowledge basePRION:CVE-2020-35177

HistoryDec 17, 2020 - 5:15 a.m.

Denial of service

2020-12-1705:15:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

CPENameOperatorVersion
vaultge1.6.0
vaultlt1.6.1
vaultge1.5.0
vaultlt1.5.6
vaultge1.6.0
vaultlt1.6.1
vaultge1.5.0
vaultlt1.5.6

Name	Operator	Version
vault	ge	1.6.0
vault	lt	1.6.1
vault	ge	1.5.0
vault	lt	1.5.6
vault	ge	1.6.0
vault	lt	1.6.1
vault	ge	1.5.0
vault	lt	1.5.6

References

discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984

github.com/hashicorp/vault/blob/master/CHANGELOG.md