CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2020-10660
Medium (5.3) in hashicorp vault. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/vault 1.3.4.
HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-276
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:vault
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m979-w9wj-qfj9 | Go | github.com/hashicorp/vault | >=0.9.0 <1.3.4 | 1.3.4 |
| GO-2024-2486 | Go | github.com/hashicorp/vault | >=0.9.0 <1.3.4 | 1.3.4 |