HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
References
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 |
01 Sep 2022, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Aug 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1. |
02 Aug 2022, 19:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:hashicorp:vault:1.11.0:*:*:*:-:*:*:* cpe:2.3:a:hashicorp:vault:1.11.0:*:*:*:enterprise:*:*:* cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420 - Vendor Advisory | |
| References | (MISC) https://discuss.hashicorp.com - Vendor Advisory | |
| CWE | CWE-863 | |
| First Time |
Hashicorp vault
Hashicorp |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
26 Jul 2022, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-26 23:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-36129
Mitre link : CVE-2022-36129
CVE.ORG link : CVE-2022-36129
JSON object : View
Products Affected
hashicorp
- vault
CWE
CWE-306
Missing Authentication for Critical Function