CVE-2020-15115

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-521

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-151176.5In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xfffCVE-2020-151185.4In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` aCVE-2020-151195.4In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is usedCVE-2020-15127.8An information disclosure vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker wCVE-2020-151204.9In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knoCVE-2020-151219.6In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's requiredCVE-2020-151239.3In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library aCVE-2020-151246.5In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the CVE-2020-151257.7In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in theCVE-2020-151266.5In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on CVE-2020-151277.5In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing CVE-2020-151286.3In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that