Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2024-8365
HistorySep 02, 2024 - 5:15 a.m.

CVE-2024-8365

2024-09-0205:15:17
CWE-532
[email protected]
web.nvd.nist.gov
3
cve-2024-8365
vault
enterprise
regression
plaintext
sensitive
headers
audit logs

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

37.7%

JSON

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.

Affected configurations

Nvd
Node
hashicorpvaultRange<1.16.9enterprise
OR
hashicorpvaultRange<1.17.5-
OR
hashicorpvaultRange1.17.0–1.17.5enterprise
VendorProductVersionCPE
hashicorpvault*cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*
hashicorpvault*cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*

Related

vulnrichment 1
osv 4
github 1
cvelist 1
redos 1
redhatcve 1
cve 1
vulnrichment
vulnrichment
CVE-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log
2024-09-02 01:30:56
osv
osv
Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault
2024-09-06 20:43:50
BIT-vault-2024-8365
2024-09-04 07:26:12
CGA-r3wc-5j5m-w78c
2024-09-05 12:04:58
github
github
Vault Leaks Client Token and Token Accessor in Audit Devices
2024-09-02 06:30:49
cvelist
cvelist
CVE-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log
2024-09-02 01:30:56
redos
redos
ROS-20240918-13
2024-09-18 00:00:00
redhatcve
redhatcve
CVE-2024-8365
2024-09-02 06:10:41
cve
cve
CVE-2024-8365
2024-09-02 05:15:17

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

37.7%

JSON
Related for NVD:CVE-2024-8365
vulnrichment1osv4github1cvelist1redos1redhatcve1cve1