CVE-2023-2121 — Cross-site Scripting in Vault

CWE-79 — Cross-site ScriptingCWE-824 — Access of Uninitialized PointerCWE-416 — Use After Free7 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.8%
top 26.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Hashicorp VaultHashicorp Vault EnterpriseGithub.com Hashicorp Vault
Timeline
PublishedJun 9
Latest updateSep 16

Description

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5hashicorp/vault_enterprise1.13.0 — 1.13.3+3
▶CVEListV5hashicorp/vault1.11.0 — 1.11.11+1
▶NVDhashicorp/vault1.12.0 — 1.12.7+2
▶Gogithub.com/hashicorp_vault1.12.0 — 1.12.7+2

🔴Vulnerability Details

3
OSV
Hashicorp Vault vulnerable to Cross-site Scripting in github.com/hashicorp/vault↗2024-08-20
▶
GHSA
Hashicorp Vault vulnerable to Cross-site Scripting↗2023-06-09
▶
OSV
Hashicorp Vault vulnerable to Cross-site Scripting↗2023-06-09
▶

📋Vendor Advisories

3
Red Hat
kernel: scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue↗2025-09-16
▶
Red Hat
vim: use-after-free in ex_substitute in Vim↗2023-11-22
▶
Red Hat
hashicorp: html injection into web ui↗2023-06-09
▶