CVE-2025-13357
Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
HIGH 7.4
En bref
- Source
- NVD
- EPSS
- EPSS 0.53 % · centile 45 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- HashiCorp
- Statut NVD
- Analyzed
Description
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.
Faiblesses (CWE)
- CWE-1188 — Initialisation par défaut non sécurisée d'une ressource
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | HashiCorp |
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · security@hashicorp.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-gmm6-j2g5-r52m — Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default
- GO-2025-4152 — Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default in github.com/hashicorp/terraform-provider-vault
Références européennes
- ENISA EUVD · EUVD-2025-198491
- GCVE · GCVE-0-2025-13357
Configurations affectées (CPE NVD)
cpe:2.3:a:hashicorp:terraform_provider:*:*:*:*:*:vault:*:*≥ 4.2.0 < 5.5.0
Produits affectés
| Produit | Versions |
|---|---|
| HashiCorp · Tooling | affected 4.2.0 < 5.5.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |