CVE-2020-25594

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests

published February 1, 2021

CVSS
—
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01355 · 71.4th percentile
Published
2021-02-01T15:41Z
EPSS history
Timeline
  • 01 FEB 15:41Z
    HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests
    cvelistv5