Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File

🗓️ 30 Mar 2023 00:10:56Reported by HashiCorp Security TeamType

hashicorp🔗 discuss.hashicorp.com👁 3 Views

Vault Microsoft SQL storage backend allows arbitrary SQL execution via configuration by a privileged attacker; fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Improper and Incorrect Authorization and SQL Injection in Vault (CVE-2023-0665, CVE-2023-24999, CVE-2023-0620)	4 Apr 202521:24	–	ibm
BDU FSTEC	The vulnerability of the MSSQL Database Storage Backend component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to execute arbitrary SQL commands.	6 Mar 202400:00	–	bdu_fstec
Chainguard	CVE-2023-0620 vulnerabilities	30 Mar 202301:15	–	cgr
Circl	CVE-2023-0620	12 Apr 202315:13	–	circl
CNNVD	HashiCorp Vault SQL注入漏洞	30 Mar 202300:00	–	cnnvd
CVE	CVE-2023-0620	30 Mar 202300:28	–	cve
Cvelist	CVE-2023-0620 Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend	30 Mar 202300:28	–	cvelist
EUVD	EUVD-2023-1105	3 Oct 202520:07	–	euvd
Github Security Blog	HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File	30 Mar 202303:30	–	github
NVD	CVE-2023-0620	30 Mar 202301:15	–	nvd