CVE-2023-3462 Vault's LDAP Auth Method Allows for User Enumeration

2023-07-3122:40:23

CWE-203

HashiCorp

www.cve.org

cve-2023-3462

vault

ldap

user enumeration

hashicorp

vulnerability

fix 1.14.1

fix 1.13.5

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

HashiCorp’s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

CNA Affected

[
  {
    "vendor": "HashiCorp",
    "product": "Vault",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux",
      "x86",
      "64 bit",
      "32 bit",
      "ARM"
    ],
    "repo": "https://github.com/hashicorp/vault",
    "versions": [
      {
        "status": "affected",
        "version": "1.13.0",
        "lessThanOrEqual": "1.13.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.14.0"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "HashiCorp",
    "product": "Vault Enterprise",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux",
      "x86",
      "ARM",
      "64 bit",
      "32 bit"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.13.0",
        "lessThanOrEqual": "1.13.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.14.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]