CVE-2024-5798

2024-06-1219:15:51

CWE-285

[email protected]

web.nvd.nist.gov

304

vault

vault enterprise

jwt

validation

cve-2024-5798

2.6 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

3.9 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.

This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Vault",
    "repo": "https://github.com/hashicorp/vault",
    "vendor": "HashiCorp",
    "versions": [
      {
        "changes": [
          {
            "at": "1.15.9",
            "status": "unaffected"
          },
          {
            "at": "1.14.13",
            "status": "unaffected"
          }
        ],
        "lessThan": "1.16.2",
        "status": "affected",
        "version": "0.11.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Vault Enterprise",
    "repo": "https://github.com/hashicorp/vault",
    "vendor": "HashiCorp",
    "versions": [
      {
        "changes": [
          {
            "at": "1.15.9",
            "status": "unaffected"
          },
          {
            "at": "1.14.13",
            "status": "unaffected"
          }
        ],
        "lessThan": "1.16.2",
        "status": "affected",
        "version": "0.11.0",
        "versionType": "semver"
      }
    ]
  }
]