CVE-2020-15115 describes a vulnerability in etcd versions prior to 3.3.23 and 3.4.10, where the software fails to enforce minimum password length, allowing for very short, easily guessable passwords. This flaw affects fedoraproject and redhat etcd and fedora products. With a CVSS score of 7.5 (HIGH), this vulnerability presents a significant risk as it can be exploited remotely with low attack complexity, potentially leading to unauthorized access and compromise of confidentiality. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.3.0, < 3.3.23CPE matchmatch criteria | cpe:2.3:a:redhat:etcd:*:*:*:*:*:*:*:* | ||
>= 3.4.0, < 3.4.10CPE matchmatch criteria | cpe:2.3:a:redhat:etcd:*:*:*:*:*:*:*:* | ||
32CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
etcd has no minimum password length
Oct 6, 2022CVE-2020-15115
Dec 14, 2021No minimum password length in etcd
Aug 11, 2020etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords
Aug 5, 2020