etcd up to 3.3.22/3.4.9 Password Policy weak password

Summaryinfo

A vulnerability described as problematic has been identified in etcd up to 3.3.22/3.4.9. Affected by this vulnerability is an unknown functionality of the component Password Policy. Executing a manipulation can lead to weak password. This vulnerability is handled as CVE-2020-15115. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in etcd up to 3.3.22/3.4.9. This vulnerability affects an unknown code block of the component Password Policy. The manipulation with an unknown input leads to a weak password vulnerability. The CWE definition for the vulnerability is CWE-521. The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts. As an impact it is known to affect confidentiality. CVE summarizes:

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

The weakness was released 08/06/2020 (GitHub Repository). The advisory is available at github.com. This vulnerability was named CVE-2020-15115 since 06/25/2020. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

Upgrading to version 3.3.23 or 3.4.10 eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-159345. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• etcd

Version

• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7
• 3.3.8
• 3.3.9
• 3.3.10
• 3.3.11
• 3.3.12
• 3.3.13
• 3.3.14
• 3.3.15
• 3.3.16
• 3.3.17
• 3.3.18
• 3.3.19
• 3.3.20
• 3.3.21
• 3.3.22
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion