Yüksek CVSS 8.1
CVE-2025-11621: Vault: kimlik doğrulama atlatma
Açıklama (NVD)
Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27
Özet bilgiler
- Ürün
- Hashicorp Vault
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - EPSS
- %0,49 (yüzdelik 42)
- CWE
- CWE-288
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| hashicorp-vault | 0.6.0 | — | 1.16.27 |
| hashicorp-vault | 0.6.0 | — | 1.21.0 |
| hashicorp-vault | 1.18.0 | 1.18.15 | — |
| hashicorp-vault | 1.19.0 | — | 1.19.11 |
| hashicorp-vault | 1.20.0 | — | 1.20.5 |