CVE-2020-35177

CVE-2020-35177

EPSS 1.3%

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

Affected products

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984 https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161