Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

🗓️ 30 Mar 2023 00:08:05Reported by HashiCorp Security TeamType

Unauthenticated Vault PKI issuer endpoints could modify or delete issuer metadata, causing denial.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Improper and Incorrect Authorization and SQL Injection in Vault (CVE-2023-0665, CVE-2023-24999, CVE-2023-0620)	4 Apr 202521:24	–	ibm
BDU FSTEC	The vulnerability of the PKI mechanism in HashiCorp’s Vault and Vault Enterprise, a platform for archiving corporate information, allows a perpetrator to trigger a service failure.	29 May 202500:00	–	bdu_fstec
Chainguard	CVE-2023-0665 vulnerabilities	30 Mar 202301:15	–	cgr
CNNVD	HashiCorp Vault 安全漏洞	30 Mar 202300:00	–	cnnvd
CVE	CVE-2023-0665	30 Mar 202300:21	–	cve
Cvelist	CVE-2023-0665 Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata	30 Mar 202300:21	–	cvelist
EUVD	EUVD-2023-1040	3 Oct 202520:07	–	euvd
Github Security Blog	HashiCorp Vault's PKI mount vulnerable to denial of service	30 Mar 202303:30	–	github
NVD	CVE-2023-0665	30 Mar 202301:15	–	nvd
OSV	BIT-VAULT-2023-0665 Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata	6 Mar 202411:09	–	osv