CVE-2020-15115
No minimum password length in etcd
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
etcd anterior a las versiones 3.3.23 y 3.4.10, no lleva a cabo ninguna comprobación de longitud de contraseña, lo que permite contraseñas muy cortas, como aquellas con una longitud de uno. Esto puede permitir a un atacante adivinar o forzar las contraseñas de los usuarios con poco esfuerzo computacional
A flaw was found in etcd, where it does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This flaw allows an attacker to guess or brute-force users' passwords with little computational effort. The highest threat from this vulnerability is to confidentiality.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-06-25 CVE Reserved
- 2020-08-06 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-305: Authentication Bypass by Primary Weakness
- CWE-521: Weak Password Requirements
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Etcd Search vendor "Redhat" for product "Etcd" | >= 3.3.0 < 3.3.23 Search vendor "Redhat" for product "Etcd" and version " >= 3.3.0 < 3.3.23" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Etcd Search vendor "Redhat" for product "Etcd" | >= 3.4.0 < 3.4.10 Search vendor "Redhat" for product "Etcd" and version " >= 3.4.0 < 3.4.10" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 32 Search vendor "Fedoraproject" for product "Fedora" and version "32" | - |
Affected
| ||||||