Vault’s KV Diff Viewer Allowed for HTML Injection

CVE-2023-2121

5.4MEDIUM

Key Information

Vendor: HashiCorp
Status: Vault; Vault Enterprise
Vendor: CVE Published:; 9 June 2023

Summary

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

Affected Version(s)

Vault < 1.13.3

Vault < 1.12.7

Vault < 1.11.11

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published.
Jun 9, 2023
Vulnerability Reserved.
Apr 17, 2023

Collectors

NVD DatabaseMitre Database