CVE-2020-25816: Critical severity hashicorp vault vulnerability
Published Sep 30, 2020
·Updated
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.
Other sources
HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.
Affected Software
5 affected componentsFixes available
HashiCorp Vault>=1.0.0<1.4.7
HashiCorp Vault>=1.0.0<1.4.7
HashiCorp Vault>=1.5.0<1.5.4
HashiCorp Vault>=1.5.0<1.5.4
go/github.com/hashicorp/vault>=1.0<1.5.4
1.5.4
Event History
Sep 30, 2020
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
Description
May 24, 2022
Advisory Published
via GitHub·10:01 PM
Frequently Asked Questions
1
What is the vulnerability ID of this HashiCorp Vault vulnerability?
The vulnerability ID is CVE-2020-25816.
2
What versions of HashiCorp Vault are affected by this vulnerability?
HashiCorp Vault versions 1.0 and newer are affected.
3
How can I fix the vulnerability in HashiCorp Vault?
The vulnerability is fixed in versions 1.4.7 and 1.5.4 of HashiCorp Vault.
4
What is the severity of CVE-2020-25816?
The severity of CVE-2020-25816 is medium with a CVSS score of 6.8.
5
Where can I find more information about this vulnerability?
You can find more information about this vulnerability in the HashiCorp Vault Changelog and the HashiCorp blog.