CVE-2023-3774

2023-07-2801:15:09

CWE-703

CWE-755

[email protected]

web.nvd.nist.gov

cve-2023-3774

vault enterprise

denial of service

nvd

security update

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.3%

JSON

An unhandled error in Vault Enterprise’s namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.

Affected configurations

NVD

Node

hashicorpvaultMatch1.12.8enterprise

hashicorpvaultMatch1.13.4enterprise

hashicorpvaultMatch1.14.0enterprise

CPENameOperatorVersion
hashicorp:vaulthashicorp vaulteq1.12.8
hashicorp:vaulthashicorp vaulteq1.13.4
hashicorp:vaulthashicorp vaulteq1.14.0

CPE	Name	Operator	Version
hashicorp:vault	hashicorp vault	eq	1.12.8
hashicorp:vault	hashicorp vault	eq	1.13.4
hashicorp:vault	hashicorp vault	eq	1.14.0

CNA Affected

[
  {
    "vendor": "HashiCorp",
    "product": "Vault Enterprise",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux",
      "x86",
      "ARM",
      "64 bit",
      "32 bit"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.14.0"
      },
      {
        "status": "affected",
        "version": "1.13.4"
      },
      {
        "status": "affected",
        "version": "1.12.8"
      }
    ],
    "defaultStatus": "unaffected"
  }
]