CVE-2023-24999

creationtimestamp| type| source ---|---|--- 2023-03-11 02:56:24+00:00| seen| https://t.me/cibsecurity/59866...

Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation

Summary When using the Vault and Vault Enterprise Vault approle auth method, any authenticated user with access to the /auth/approle/role/:rolename/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-249...