{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-30T23:12:20.082","vulnerabilities":[{"cve":{"id":"CVE-2025-6013","sourceIdentifier":"security@hashicorp.com","published":"2025-08-06T10:15:35.423","lastModified":"2025-12-15T16:13:23.290","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24."},{"lang":"es","value":"Es posible que el método de autenticación LDAP de Vault y Vault Enterprise (Vault) no haya aplicado correctamente la MFA si `username_as_alias` se configuró como `true` y un usuario tenía varios CN iguales, pero con espacios al principio o al final. Corregido en Vault Community Edition 1.20.2 y Vault Enterprise 1.20.2, 1.19.8, 1.18.13 y 1.16.24."}],"metrics":{"cvssMetricV31":[{"source":"security@hashicorp.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"weaknesses":[{"source":"security@hashicorp.com","type":"Secondary","description":[{"lang":"en","value":"CWE-156"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.10.0","versionEndIncluding":"1.15.16","matchCriteriaId":"B16132D8-D157-4D41-800F-539405F740D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*","versionStartIncluding":"1.10.0","versionEndExcluding":"1.20.2","matchCriteriaId":"96BCED27-A0D8-4464-9CF9-5C3BB548AB8B"},{"vulnerable":true,"criteria":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.16.0","versionEndExcluding":"1.16.24","matchCriteriaId":"67AFF685-3E84-40F2-8FE8-C38932AC5913"},{"vulnerable":true,"criteria":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.17.0","versionEndExcluding":"1.18.13","matchCriteriaId":"7F0CC3D0-6091-4BE3-903C-A493C34A9D93"},{"vulnerable":true,"criteria":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.19.0","versionEndExcluding":"1.19.8","matchCriteriaId":"518C1F60-EF80-4578-8391-6CD543EF9F6A"},{"vulnerable":true,"criteria":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.20.0","versionEndExcluding":"1.20.2","matchCriteriaId":"4C71EDE5-5D3E-445E-9441-D422E8E3942C"}]}]}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092","source":"security@hashicorp.com","tags":["Vendor Advisory"]}]}}]}