CVE-2021-32923

Published Jun 3, 2021

Last updated 2 years ago

CVSS high 7.4

Overview

Description: HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.4
Impact score: 5.2
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 5.8
Impact score: 4.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-613

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "14A9B0B2-7CB2-4C58-A533-C8B8A384B9E7",
            "versionEndExcluding": "1.5.9",
            "versionStartIncluding": "0.10.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0A1393FB-B347-43B0-B385-778DB91EE17D",
            "versionEndExcluding": "1.5.9",
            "versionStartIncluding": "0.10.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "982EA447-6427-441A-969C-F15CA795CB2E",
            "versionEndExcluding": "1.6.5",
            "versionStartIncluding": "1.6.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3AD3802D-3031-4639-B4F6-ECB64F776333",
            "versionEndExcluding": "1.6.5",
            "versionStartIncluding": "1.6.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B0BC9967-86A5-47F4-86A5-35B32A677BA6",
            "versionEndExcluding": "1.7.2",
            "versionStartIncluding": "1.7.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E6D1D690-7B01-483A-AF34-F26AAE923A43",
            "versionEndExcluding": "1.7.2",
            "versionStartIncluding": "1.7.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References