CVE-2021-27668 — Missing Authentication for Critical Function in Vault

CWE-306 — Missing Authentication for Critical FunctionCWE-287 — Improper Authentication3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.3%
top 42.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Hashicorp Vault
Timeline
PublishedAug 31
Latest updateMay 24

Description

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

▶NVDhashicorp/vault0.9.2 — 1.6.3

🔴Vulnerability Details

1
GHSA
GHSA-mfpx-cx7p-6jc6: HashiCorp Vault Enterprise 0↗2022-05-24
▶

📋Vendor Advisories

1
Red Hat
vault: Vault Enterprise’s DR Secondaries Exposed License Metadata Without Authentication↗2021-08-31
▶