What is GHSA-j6vv-vv26-rh7c?

GHSA-j6vv-vv26-rh7c is a security advisory published by GitHub Security Advisories with Critical severity. HashiCorp Vault Improper Privilege Management

Which CVE IDs does GHSA-j6vv-vv26-rh7c cover?

GHSA-j6vv-vv26-rh7c covers the following CVE IDs: CVE-2020-10661. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j6vv-vv26-rh7c?

GHSA-j6vv-vv26-rh7c has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-j6vv-vv26-rh7c?

GHSA-j6vv-vv26-rh7c affects 1 product, including: go/github.com/hashicorp/vault:\u003e= 0.11.0, \u003c 1.3.4.

GHSA-j6vv-vv26-rh7cCriticalCVSS 9.1

HashiCorp Vault Improper Privilege Management

Vendor

GitHub Security Advisories

Published

January 30, 2024

Last Modified

September 16, 2024

🔗 CVE IDs covered (1)

CVE-2020-10661 →

📋 Description

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.

🎯 Affected products1

go/github.com/hashicorp/vault:>= 0.11.0, < 1.3.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-10661
https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020
https://www.hashicorp.com/blog/category/vault
https://github.com/advisories/GHSA-j6vv-vv26-rh7c