Login Request a demo
High severity · published Mar 11, 2023
CVE-2023-24999
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by…
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vault · Hashicorp
before 1.10.11; before 1.10.11; 1.11.0 before 1.11.8; 1.11.0 before 1.11.8; 1.12.0 before 1.12.4; 1.12.0 before 1.12.4 · source: NVD
Affected product
VA
Vault
Hashicorp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24999
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305
security.netapp.com
https://security.netapp.com/advisory/ntap-20230505-0001/
More from Vault
9.8
CVE-2024-2048
Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
9.8
CVE-2020-35192
The official vault docker images before 0.11.6 contain a blank password for a root user
9.8
CVE-2020-12757
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease…
9.1
CVE-2025-6000
Arbitrary Remote Code Execution via Plugin Catalog Abuse
9.1
CVE-2022-40186
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3