CVE-2020-15115

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
etcd-io	etcd	< 3.3.23; < 3.4.10

References

Timeline

Published: Aug 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151176.5In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xfff CVE-2020-151185.4In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` a CVE-2020-151195.4In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used CVE-2020-15127.8An information disclosure vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker w CVE-2020-151204.9In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without kno CVE-2020-151219.6In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required CVE-2020-151239.3In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library a CVE-2020-151246.5In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the CVE-2020-151257.7In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the CVE-2020-151266.5In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on CVE-2020-151277.5In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing CVE-2020-151286.3In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that