CVE-2023-5077 Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

2023-09-2823:24:28

CWE-266

HashiCorp

github.com

cve-2023-5077

vault

google cloud

secrets engine

iam conditions

rolesets

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

The Vault and Vault Enterprise (“Vault”) Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*"
    ],
    "vendor": "hashicorp",
    "product": "vault",
    "versions": [
      {
        "status": "affected",
        "version": "0.10.0",
        "lessThan": "1.13.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*"
    ],
    "vendor": "hashicorp",
    "product": "vault",
    "versions": [
      {
        "status": "affected",
        "version": "00.10.0",
        "lessThan": "1.13.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]