Vault’s KV Diff Viewer Allowed for HTML Injection
CVE-2023-2121

5.4MEDIUM

Key Information:

Vendor
HashiCorp
Status
Vault
Vault Enterprise
Vendor
CVE Published:
9 June 2023

Summary

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

Affected Version(s)

Vault Enterprise Windows 1.13.0 < 1.13.3

Vault Enterprise Windows 1.12.0 < 1.12.7

Vault Enterprise Windows 1.11.0 < 1.11.11

References

https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.