CVE-2021-3024

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

CVE-2020-25594

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

CVE-2020-25594

CVE-2020-25594 affects HashiCorp Vault and Vault Enterprise. The issue allowed unauthenticated HTTP requests to enumerate Secrets Engine mount paths. This was fixed in Vault 1.6.2 and Vault Enterprise 1.5.7. The connected sources confirm the vulnerability description and the remediation versions;...

CVE-2020-25594

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

CVE-2021-3282

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2...

CVE-2021-3282

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2...

CVE-2021-3282

CVE-2021-3282 affects HashiCorp Vault Enterprise 1.6.0 and 1.6.1, where the remove-peer raft operator command could be executed against disaster-recovery (DR) secondary nodes without authentication. The underlying issue allowed an unauthenticated action on DR secondaries, potentially enabling una...

CVE-2021-3282

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2...

PT-2021-11163 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.5.7 HashiCorp Vault and Vault Enterprise versions prior to 1.6.2 Description: The issue allows for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests...

CVE-2021-3024: Undefined Security Weakness

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

PT-2021-19953

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Enterprise versions 1.6.0 through 1.6.1 Description The issue allows the remove-peer raft operator command to be executed against DR secondaries without authentication. This affects HashiCorp Vault Enterprise. Recommendations F...

Hashicorp Vault Security Vulnerability

Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. A security vulnerability exists in HashiCorp Vault and Vault Enterprise that allows enumeration of secret engine mount paths via an unauthenticated HTTP request...

HashiCorp Vault and Vault Enterprise Security Vulnerabilities

Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. A security vulnerability exists in the HashiCorp Vault and Vault Enterprise that stems from the disclosure of the internal IP address of a Vault node in response to some invalid, unauthenticated HTTP...

PT-2021-18682 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.5.7 HashiCorp Vault and Vault Enterprise versions prior to 1.6.2 Description: The issue allows the disclosure of the internal IP address of the Vault node when responding to some invali...

CVE-2021-3282: Improper Authentication

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2...

CVE-2020-25594: Undefined Security Weakness

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

HashiCorp Vault Enterprise 授权问题漏洞

HashiCorp Vault is a private key access management tool from HashiCorp USA. An unauthorized access vulnerability exists in HashiCorp Vault Enterprise versions 1.6.0 and 1.6.1 that allows execution of the remove-peer raft operator command on the disaster recovery side without authentication. No...

Vault Enterprise’s DR Secondaries Allowed Raft Peer Removal Without Authentication

Summary Vault Enterprise 1.6.0 and 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. This vulnerability, CVE-2021-3282, was fixed in Vault Enterprise 1.6.2. Background Vault Enterprise clusters configured with integrated storage also...

Vault API Endpoint Allowed Enumeration of Secrets Engine Mount Paths Without Authentication

Summary Vault and Vault Enterprise “Vault” allowed the enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. This vulnerability, CVE-2020-25594, was fixed in Vault 1.6.2 & 1.5.7. Background Vault operators are able to mount Secrets Engines at customizable paths. Secrets...

Vault API Endpoint Exposed Internal IP Address Without Authentication

Summary Vault and Vault Enterprise “Vault” would disclose the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. This vulnerability, CVE-2021-3024, was fixed in Vault 1.6.2 & 1.5.7. Background Vault’s API is the primary means by which a Vault nod...