GitHub Advisoryadvisory · Go

GHSA-qv95-g3gm-x542 Hashicorp Vault Privilege Escalation Vulnerability

LOW Published 2021-10-12 Modified 2022-08-10 Official page ↗
Aliases
CVE-2021-41802
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Low
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-269, CWE-732
Reviewed
2021-10-11

Affected packages

• Go github.com/hashicorp/vault: < 1.7.5 → fixed in 1.7.5 • Go github.com/hashicorp/vault: >= 1.8.0, < 1.8.4 → fixed in 1.8.4

Description

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

Related

Alias · CVE (1)

  • CVE-2021-41802 HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References