MEDIUM🇬🇧 English

CVE-2023-4680

CVSS 6.8v3.1pub. 2023-09-15upd. 2024-11-21

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

  • Hashicorp Vault

    APP
    Hashicorp
    1.6.0 – 1.12.11 (bez)1.13.0 – 1.13.7 (bez)1.14.0 – 1.14.3 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2025-6000CRITICAL9.1PL ✓ten sam produkt

HashiCorp Vault: RCE przez uprzywilejowanego operatora via sys/audit

CVE-2022-40186CRITICAL9.1ten sam produkt

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity...

CVE-2022-36129CRITICAL9.1ten sam produkt

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an...

CVE-2020-35192CRITICAL9.8ten sam produkt

The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vaul...

CVE-2020-12757CRITICAL9.8ten sam produkt

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorre...