GHSA-4mp7-2m29-gqxf

Source

https://github.com/advisories/GHSA-4mp7-2m29-gqxf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-4mp7-2m29-gqxf/GHSA-4mp7-2m29-gqxf.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4mp7-2m29-gqxf

Aliases

Published

2024-01-31T00:21:58Z

Modified

2024-09-16T17:21:31Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator

Summary

HashiCorp Vault Authentication bypass

Details

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

Database specific

{
    "nvd_published_at": "2020-08-26T15:15:12Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-31T00:21:58Z"
}

References