GHSA-fp52-qw33-mfmw

Source

https://github.com/advisories/GHSA-fp52-qw33-mfmw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-fp52-qw33-mfmw/GHSA-fp52-qw33-mfmw.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-fp52-qw33-mfmw

Aliases

Related

CGA-h425-mx3f-g92v

Published

2021-08-02T17:11:41Z

Modified

2024-09-11T06:13:09.812761Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator

Summary

Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

Details

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

Database specific

{
    "nvd_published_at": "2020-08-26T15:15:00Z",
    "cwe_ids": [
        "CWE-290",
        "CWE-345"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-07-26T18:55:09Z"
}

References