Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

CVE-2024-2877
5.5MEDIUM

Key Information

Vendor
Hashicorp
Status
Vault Enterprise
Vendor
CVE Published:
30 April 2024

Summary

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

Affected Version(s)

Vault Enterprise < 1.15.8

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Risk change from: null to: 5.5 - (MEDIUM)

  • Vulnerability published.

Collectors

NVD DatabaseMitre Database
.