HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
References
| Link | Resource |
|---|---|
| https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168 | Vendor Advisory |
| https://security.gentoo.org/glsa/202207-01 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
25 Oct 2022, 20:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | (GENTOO) https://security.gentoo.org/glsa/202207-01 - Third Party Advisory |
01 Aug 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Sep 2021, 17:05
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 4.4 |
25 Aug 2021, 13:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168 - Vendor Advisory | |
| CWE | CWE-281 | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| CPE | cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* |
13 Aug 2021, 16:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-13 16:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-38553
Mitre link : CVE-2021-38553
CVE.ORG link : CVE-2021-38553
JSON object : View
Products Affected
hashicorp
- vault
CWE
CWE-281
Improper Preservation of Permissions