CVE-2020-15115
Last modified
CVE-2020-15115 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.. EPSS estimates a 1.34% chance of exploitation in the next 30 days.
Description
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Etcd | >= 3.3.0, < 3.3.23 |
| Redhat | Etcd | >= 3.4.0, < 3.4.10 |
| Fedoraproject | Fedora | 32 |
References
- https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hhThird Party Advisory
- https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hhThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-15115?
How severe is CVE-2020-15115?
How do I fix CVE-2020-15115?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8
- CVE-2020-15110In jupyterhub-kubespawner before 0.12, certain usernames wil…8.1
- CVE-2020-15111In Fiber before version 1.12.6, the filename that is given i…5.4
- CVE-2020-15112In etcd before versions 3.3.23 and 3.4.10, it is possible to…6.5
- CVE-2020-15113In etcd before versions 3.3.23 and 3.4.10, certain directory…7.1
- CVE-2020-15114In etcd before versions 3.3.23 and 3.4.10, the etcd gateway …7.7
- CVE-2020-15117In Synergy before version 1.12.0, a Synergy server can be cr…6.5
- CVE-2020-15118In Wagtail before versions 2.7.4 and 2.9.3, when a form page…5.4
- CVE-2020-15119In auth0-lock versions before and including 11.25.1, dangero…5.4
- CVE-2020-1512An information disclosure vulnerability exists when the Wind…7.8
- CVE-2020-15120In "I hate money" before version 4.1.5, an authenticated mem…4.9
- CVE-2020-15121In radare2 before version 4.5.0, malformed PDB file names in…9.6
Are you affected by CVE-2020-15115?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST