HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/hashicorp/vault(Go) | 0 | 1.13.5 | N/A |
| github.com/hashicorp/vault(Go) | 1.14.0 | 1.14.1 | N/A |
CVSS Metrics
