GitHub Advisoryadvisory · Go

GHSA-86c6-3g63-5w64 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

HIGH Published 2023-09-29 Modified 2023-09-29 Official page ↗
Aliases
CVE-2023-5077
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-266, CWE-732
Reviewed
2023-09-29

Affected packages

• Go github.com/hashicorp/vault: < 1.13.0 → fixed in 1.13.0

Description

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Related

Alias · CVE (1)

  • CVE-2023-5077 The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or… vulnerability

Weakness · CWE (2)

  • CWE-266 Incorrect Privilege Assignment weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References