MEDIUM🇵🇱 Wersja polska

CVE-2025-6014

CVSS 6.5v3.1pub. 2025-08-01upd. 2025-08-13

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Hashicorp Vault

    APP
    Hashicorp
    1.20.0< 1.16.23< 1.20.11.17.0 – 1.18.12 (bez)1.19.0 – 1.19.7 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-6000CRITICAL9.1PL ✓ten sam produkt

HashiCorp Vault: RCE przez uprzywilejowanego operatora via sys/audit

CVE-2022-40186CRITICAL9.1ten sam produkt

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity...

CVE-2022-36129CRITICAL9.1ten sam produkt

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an...

CVE-2020-35192CRITICAL9.8ten sam produkt

The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vaul...

CVE-2020-12757CRITICAL9.8ten sam produkt

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorre...

CVE-2025-6014 — Hashicorp — Vault — MEDIUM — CVSS 6.5 | CVEbaza.pl