CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

CVSS v3 8.2 HIGH
CVSS v2.0 7.5 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html	Third Party Advisory VDB Entry
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151	Release Notes Vendor Advisory
https://www.hashicorp.com/blog/category/vault/	Product Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hashicorp:vault:::::-:::*
	cpe:2.3:a:hashicorp:vault:::::enterprise:::*

Configuration 2 (hide)

OR	cpe:2.3:a:hashicorp:vault:::::-:::*
	cpe:2.3:a:hashicorp:vault:::::enterprise:::*

Configuration 3 (hide)

OR	cpe:2.3:a:hashicorp:vault:::::-:::*
	cpe:2.3:a:hashicorp:vault:::::enterprise:::*

Configuration 4 (hide)

OR	cpe:2.3:a:hashicorp:vault:::::-:::*
	cpe:2.3:a:hashicorp:vault:::::enterprise:::*

History

29 Aug 2023, 17:13

Type	Values Removed	Values Added
CVSS	v2 : ~~7.5~~ v3 : ~~9.8~~	v2 : 7.5 v3 : 8.2

Information

Published : 2020-08-26 15:15

Updated : 2024-02-28 17:47

NVD link : CVE-2020-16250

Mitre link : CVE-2020-16250

CVE.ORG link : CVE-2020-16250

JSON object : View

Products Affected

hashicorp

vault

CWE

CWE-290

Authentication Bypass by Spoofing

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2020-16250", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "published": "2020-08-26T15:15:12.850", "references": [{"url": "http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.hashicorp.com/blog/category/vault/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.."}, {"lang": "es", "value": "HashiCorp Vault y Vault Enterprise versiones 0.7.1 y posteriores, cuando son configuradas con el m\u00e9todo de autenticaci\u00f3n AWS IAM, pueden ser vulnerables a una omisi\u00f3n de autenticaci\u00f3n. Corregido en 1.2.5, 1.3.8, 1.4.4 y 1.5.1.."}], "lastModified": "2023-08-29T17:13:35.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "D2494214-E6B2-4322-AA79-CC4AE1959760", "versionEndExcluding": "1.2.5", "versionStartIncluding": "0.7.1"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "24DC6241-A2AA-45DD-B2E9-82DEE9FF0DB2", "versionEndExcluding": "1.2.5", "versionStartIncluding": "0.7.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "78915E16-7E2F-4DDA-89FF-1751B6546FC2", "versionEndExcluding": "1.3.8", "versionStartIncluding": "1.3.0"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "269A36BC-B728-4AFA-B08B-0C04B22DFEC9", "versionEndExcluding": "1.3.8", "versionStartIncluding": "1.3.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "E03B11E5-953A-4D0E-A75C-87F43BE0F323", "versionEndExcluding": "1.4.4", "versionStartIncluding": "1.4.0"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "68A9A5AE-CC39-4296-95AF-6E2C13C64C51", "versionEndExcluding": "1.4.4", "versionStartIncluding": "1.4.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "894E4573-D9DF-4357-AAA8-50CA95A4CD2B", "versionEndExcluding": "1.5.1", "versionStartIncluding": "1.5.0"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6813A54F-6259-40AA-BBF5-90DB0480813D", "versionEndExcluding": "1.5.1", "versionStartIncluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}