VDB
CVE-2025-13357
CVE-2025-13357
PUBLISHED
CVSS 7.400000095367432 HIGH
Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default
EPSS 0.02% · 4.8th percentile
Risk Scores
CVSS v3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.02%
4.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| hashicorp | terraform_provider | 4.2.0 |
| github.com | hashicorp/terraform-provider-vault | 0 |
| HashiCorp | Tooling | 4.2.0 |
Timeline
- Nov 21, 2025 CVE Published
- Nov 21, 2025 Coalition ESS Score
- Nov 21, 2025 PoC Published
- Nov 22, 2025 EPSS Score
- Nov 25, 2025 PoC Published
- Nov 27, 2025 CVE Updated
- Nov 27, 2025 EPSS Score
- Dec 2, 2025 EPSS Score
- Dec 5, 2025 Coalition ESS Score
- Dec 6, 2025 EPSS Score
- Dec 10, 2025 Coalition ESS Score
- Dec 11, 2025 EPSS Score
References
- https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-13357 advisory
- https://github.com/hashicorp/terraform-provider-vault/pull/2622 url
- https://github.com/hashicorp/terraform-provider-vault/commit/882bc7f409acc99c872c345edd65159d9568589a url
- https://github.com/advisories/GHSA-gmm6-j2g5-r52m advisory
- https://github.com/hashicorp/terraform-provider-vault package
- https://github.com/hashicorp/terraform-provider-vault/releases/tag/v5.5.0 url