Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node
CVE-2024-2877

5.5MEDIUM

Key Information:

Vendor
Hashicorp
Status
Vault Enterprise
Vendor
CVE Published:
30 April 2024

Summary

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext.

This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

Affected Version(s)

Vault Enterprise 64 bit 1.15.0 < 1.15.8

References

https://discuss.hashicorp.com/t/hsec-2024-10-vault-enterp...
https://security.netapp.com/advisory/ntap-20240614-0002/

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre Database
.