# HCSEC-2020-25 - Vault’s LDAP Auth Method Allows User Enumeration

**URL:** <https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984>\
**Category:** Security\
**Tags:** security-vault\
**Created:** [December 16, 2020, 11:09pm UTC](https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984 "2020-12-16T23:09:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [December 16, 2020, 11:09pm UTC](https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984/1 "2020-12-16T23:09:05Z")

</div>

**Bulletin ID:** HCSEC-2020-25  
**Affected Products / Versions:** Vault and Vault Enterprise 1.4.1 and newer; fixed in 1.6.1 & 1.5.6.  
**Publication Date:** 16 December, 2020

**Summary**  
Vault and Vault Enterprise (“Vault”) allowed enumeration of users via the LDAP auth method. This vulnerability, CVE-2020-35177, was introduced in Vault 1.4.1 and fixed in Vault 1.6.1 and 1.5.6.

**Background**  
The Vault LDAP auth method (documented at [LDAP - Auth Methods | Vault by HashiCorp](https://www.vaultproject.io/docs/auth/ldap)) allows authentication using an existing LDAP server and user/password credentials.

**Details**  
An external party reported that they were able to enumerate LDAP users via error messages returned by Vault’s LDAP auth method.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Vault or Vault Enterprise 1.6.1, 1.5.6, or newer. Please refer to [Upgrading Vault](https://www.vaultproject.io/docs/upgrading) for general guidance and version-specific upgrade notes.

**Acknowledgement**  
This issue was identified by an external party who reported it to HashiCorp.

_We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._