CVE-2022-36129 — Missing Authentication for Critical Function in Vault

CWE-306 — Missing Authentication for Critical FunctionCWE-863 — Incorrect Authorization3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
1.1%
top 21.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Hashicorp Vault
Timeline
PublishedJul 26
Latest updateJul 27

Description

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

▶NVDhashicorp/vault1.7.0 — 1.9.7+2

🔴Vulnerability Details

1
GHSA
GHSA-c8mv-ccvj-9h5q: HashiCorp Vault and Vault Enterprise through 2022-07-17 have Incorrect Access Control↗2022-07-27
▶

📋Vendor Advisories

1
Red Hat
vault: Vault Enterprise Does Not Verify Existing Voter Status When Joining An Integrated Storage HA Node↗2022-07-27
▶