Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation

When using the Vault and Vault Enterprise Vault approle auth method, any authenticated user with access to the /auth/approle/role/:rolename/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999, has...

GHSA-9MH8-9J64-443F HashiCorp Vault's revocation list not respected

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

HashiCorp Vault's revocation list not respected

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

Incorrect Use of Equality Operator in addPartner and addVault Functions

Lines of code Vulnerability details Impact The addPartner and addVault functions in the PartnerManagerFactory contract are intended to add new partner managers and vaults respectively. These functions also assign a unique ID to each new partner manager and vault by storing them in the partnerIds...

CVE-2023-2400

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access...

CVE-2023-2400

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access...

HTML Injection

github.com/hashicorp/vault is vulnerable to HTML Injection. The vulnerability exists due to improper input sanitization in the diff viewer component, which allows an attacker to inject and execute malicious HTML via web UI's key valueskv-v2...

CVE-2023-2121

A flaw was found in HashiCorp Vault and Vault Enterprise, where they are vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the key-value v2 kv-v2 diff viewer. A remote, authenticated attacker can inject malicious script into a Web page which would be...

GHSA-GQ98-53RQ-QR5H Hashicorp Vault vulnerable to Cross-site Scripting

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

Hashicorp Vault vulnerable to Cross-site Scripting

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

CVE-2023-2121

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

Input validation

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

CVE-2023-2121

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

CVE-2023-2121

The CVE-2023-2121 issue affects HashiCorp Vault and Vault Enterprise, stemming from the key-value v2 (kv-v2) diff viewer and improper input handling that allowed HTML injection in the Vault web UI. The vulnerability could enable cross-site scripting through user-supplied values rendered by the di...

CVE-2023-2121 Vault’s KV Diff Viewer Allowed for HTML Injection

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

CVE-2023-2121 Vault’s KV Diff Viewer Allowed for HTML Injection

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

CVE-2023-2121 Vault’s KV Diff Viewer Allowed for HTML Injection

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

Vault’s KV Diff Viewer Allowed HTML Injection

Summary Vault and Vault Enterprise’s Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. Background Vault 1.10.0 introduced the ability to easily review the...

PT-2023-17999 · Hashicorp +1 · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: Hashicorp Vault versions prior to 1.11.11 Hashicorp Vault versions prior to 1.12.7 Hashicorp Vault versions prior to 1.13.3 Hashicorp Vault versions prior to 1.14.0 Description: The key-value v2 kv-v2 diff viewer in Vault allowed HTML injecti...

HashiCorp Vault 跨站脚本漏洞

HashiCorp Vault is a private key access management tool from HashiCorp USA. A security vulnerability exists in Vault and Vault Enterprise version 1.0.0 that stems from allowing HTML code to be injected into the Vault Web UI via key-value key-value v2...