CVE-2023-0665

Published Mar 30, 2023

Last updated a year ago

Overview

Description: HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Source: security@hashicorp.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 2.5
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-Other
security@hashicorp.com: CWE-285

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C565DBD-95F4-4951-A029-93ABE5315740",
            "versionEndExcluding": "1.11.9"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "80EB9F32-09A4-469C-AF76-1AE3137EAC1B",
            "versionEndExcluding": "1.11.9"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "446F872F-F64C-44CA-85BC-144FCFBCFA8B",
            "versionEndExcluding": "1.12.5",
            "versionStartIncluding": "1.12.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "71A02FE6-C8D4-455D-A71A-C8353E1ECB7C",
            "versionEndExcluding": "1.12.5",
            "versionStartIncluding": "1.12.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "81280166-3DF7-4867-95E9-A7AFB9A12CE7",
            "versionEndExcluding": "1.13.1",
            "versionStartIncluding": "1.13.0"
          },
          {
            "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C56E203C-1E18-4395-B500-B6EA695B16C0",
            "versionEndExcluding": "1.13.1",
            "versionStartIncluding": "1.13.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References