CVE-2024-2877 — Log File Information Exposure in Vault Enterprise

CWE-532 — Log File Information Exposure2 documents2 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 82.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Hashicorp Vault EnterpriseHashicorp Vault
Timeline
PublishedApr 30

Description

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5hashicorp/vault_enterprise1.15.0 — 1.15.8
▶NVDhashicorp/vault1.15.0 — 1.15.8

🔴Vulnerability Details

1
GHSA
GHSA-vxc5-78f8-rhp4: Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby↗2024-04-30
▶