CVE-2023-5077

Thursday, September 28, 2023

7.6

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Summary

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Affected Software

Vendor	Product	Version Range	Status
HashiCorp	Vault	`0.10.0 < 1.13.0`	affected
HashiCorp	Vault Enterprise	`0.10.0 < 1.13.0`	affected

Weaknesses

CWE-266: CWE-266: Incorrect Privilege Assignment

ADP Enrichment

CVE Program Container

Additional References

https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

References

https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.