En bref
- CVE-2020-12757 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant github.com/hashicorp/vault-plugin-secrets-gcp, vault (hashicorp).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.6%, plus élevée que 75.2% des vulnérabilités.
- Correctif : mettre à jour vers 0.6.2, 1.4.2 ou plus récent.
Description
HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.
NVD description
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free