CVE-2025-6000
Arbitrary Remote Code Execution via Plugin Catalog Abuse
Résumé
Arbitrary Remote Code Execution via Plugin Catalog Abuse
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"1.20.1"}]}]
Références
- advisory discuss.hashicorp.com
- web nvd.nist.gov