Authorization Bypass

2021-04-2301:33:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

74.2%

JSON

github.com/hashicorp/terraform-provider-vault is vulnerable to authorization bypass. The insecure configuration in GCE-type bound labels for GCP auth method could allow for an attacker to bypass authorization and access otherwise restricted actions.

CPENameOperatorVersion
github.com/hashicorp/terraform-provider-vaultlev2.17.0

CPE	Name	Operator	Version
	github.com/hashicorp/terraform-provider-vault	le	v2.17.0

References

discuss.hashicorp.com/t/hcsec-2021-11-terraform-s-vault-provider-did-not-correctly-configure-bound-labels-for-gcp-auth/23464/2

github.com/hashicorp/terraform-provider-vault/issues/996

github.com/hashicorp/terraform-provider-vault/pull/1028

0.004 Low

EPSS

Percentile

74.2%

JSON

Related for VERACODE:30135