GitHub Advisoryadvisory · Go

GHSA-gq98-53rq-qr5h Hashicorp Vault vulnerable to Cross-site Scripting

MEDIUM Published 2023-06-09 Modified 2023-06-09 Official page ↗
Aliases
CVE-2023-2121
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-06-09

Affected packages

• Go github.com/hashicorp/vault: < 1.11.11 → fixed in 1.11.11 • Go github.com/hashicorp/vault: >= 1.12.0, < 1.12.7 → fixed in 1.12.7 • Go github.com/hashicorp/vault: >= 1.13.0, < 1.13.3 → fixed in 1.13.3

Description

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

Related

Alias · CVE (1)

  • CVE-2023-2121 Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References