Advisoriesby IbisVaultGHSA-9v3w-w2jh-4hff
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration
Fix: upgrade to 1.13.5 or later (2 fixed versions below)
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | < 1.13.5 | 1.13.5 |
| >= 1.14.0, < 1.14.1 | 1.14.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-203
- Also known as
- BIT-vault-2023-3462, CVE-2023-3462, GO-2023-1986
More Vault advisories
All Vault
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerabilityCVE-2023-5954fixed in 1.13.10 +2Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerabilityCVE-2023-5077fixed in 1.13.0HashiCorp Vault Improper Input Validation vulnerabilityCVE-2023-4680fixed in 1.12.11 +2Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy OperationCVE-2023-24999fixed in 1.10.11 +2HashiCorp Vault's revocation list not respectedCVE-2022-41316fixed in 1.9.10 +2Hashicorp Vault vulnerable to Cross-site ScriptingCVE-2023-2121fixed in 1.11.11 +2