CVE-2020-15115: No minimum password length in etcd
A flaw was found in etcd, where it does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This flaw allows an attacker to guess or brute-force users' passwords with little computational effort. The highest threat from this vulnerability is to confidentiality.
Other sources
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
etcd-io etcd could allow a remote attacker to obtain sensitive information, caused by improper password length validation. By using brute-force attack techniques, an attacker could exploit this vulnerability to obtain user credentials, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15115?
CVE-2020-15115 is classified as a high-severity vulnerability due to the potential for brute-force attacks on user passwords.
How do I fix CVE-2020-15115?
To fix CVE-2020-15115, upgrade etcd to version 3.4.10 or 3.3.23 or later as recommended by Red Hat.
What software is affected by CVE-2020-15115?
CVE-2020-15115 affects etcd versions prior to 3.4.10 and 3.3.23.
What type of flaw is CVE-2020-15115?
CVE-2020-15115 is a flaw related to insufficient password length validation.
Can CVE-2020-15115 be exploited remotely?
Yes, CVE-2020-15115 can be exploited remotely by attackers to guess or brute-force passwords.