{"id":"CVE-2020-10661","published":"2020-03-23T12:57:03Z","modified":"2024-08-04T11:06:10Z","title":"HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing…","vendor":null,"product":null,"tier":"tail","description":{"text":"HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01116,"percentile":0.65986,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.hashicorp.com/blog/category/vault/","tags":["x_refsource_MISC"]},{"url":"https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.2,"factors":[{"name":"EPSS percentile","points":13.2}]},"affected":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","vulnerableRanges":[">=0.11.0, <1.3.4"],"patched":["1.3.4"],"from":["GHSA-j6vv-vv26-rh7c","GO-2024-2485"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0375","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-hashicorp-vault-cve-2020-10660","children":[{"from":"CVE-2020-10661","to":"CVE-2020-25816","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["vault/expiration.go","vault/request_handling.go"],"commits":["https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a","https://github.com/hashicorp/vault/commit/f192878110fe93eb13da914b2bee28caa7866a29"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-7220","published":"2020-01-23","fixed":"1.3.2","kev":false,"link":{"from":"CVE-2020-7220","to":"CVE-2020-10661","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/vault","fromFixed":"1.3.2","toFixed":"1.3.4","daysApart":60}]}},{"cve":"CVE-2020-10660","published":"2020-03-23","fixed":"1.3.4","kev":false},{"cve":"CVE-2020-10661","published":"2020-03-23","fixed":"1.3.4","kev":false},{"cve":"CVE-2020-13223","published":"2020-06-10","fixed":"1.4.2","kev":false},{"cve":"CVE-2020-16250","published":"2020-08-26","fixed":"1.5.1","kev":false},{"cve":"CVE-2020-16251","published":"2020-08-26","fixed":"1.5.1","kev":false}],"package":"Go:github.com/hashicorp/vault"}}