Advisoriesby IbisVaultGHSA-c5wc-v287-82pc
HashiCorp Vault improper configuration of multi factor authentication
Fix: upgrade to 1.10.3 or later
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.10.0, < 1.10.3 | 1.10.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Also known as
- BIT-vault-2022-30689, CVE-2022-30689, GO-2022-0590
More Vault advisories
All Vault
HashiCorp Vault vulnerable to incorrect metadata accessCVE-2022-40186fixed in 1.9.9 +2Token leases could outlive their TTL in HashiCorp VaultCVE-2020-25816fixed in 1.5.4HashiCorp Vault Incorrect Permission Assignment for Critical ResourceCVE-2021-43998fixed in 1.7.6 +1Incorrect Privilege Assignment in HashiCorp VaultCVE-2021-42135no fix yetHashicorp Vault Privilege Escalation VulnerabilityCVE-2021-41802fixed in 1.7.5 +1HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0CVE-2021-38553fixed in 1.8.0