CVE-2020-35177

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-35185.4A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remCVE-2020-351849.8The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployCVE-2020-351859.8The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docCVE-2020-351869.8The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container CVE-2020-351879.8The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraCVE-2020-351899.8The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong dockerCVE-2020-35198.1A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attaCVE-2020-351909.8The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using thCVE-2020-351919.8The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupCVE-2020-351929.8The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed byCVE-2020-351939.8The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube doCVE-2020-351959.8The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy
CVE-2020-35177: Medium severity, CVSS 5.3 | Vulnix