Medium severity · published Sep 14, 2023
CVE-2023-4680
Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vault · HashiCorp
1.14.0 before 1.14.3; 1.13.0 before 1.13.7; 1.12.0 before 1.12.11; 1.6.0 before 1.12.0 · source: vendor, NVD, CISA
VE
Vault Enterprise · HashiCorp
1.14.0 before 1.14.3; 1.13.0 before 1.13.7; 1.12.0 before 1.12.11; 1.6.0 before 1.12.0 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4680
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4680
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249
More from Vault
9.8
CVE-2024-2048
Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
9.8
CVE-2020-35192
The official vault docker images before 0.11.6 contain a blank password for a root user
9.8
CVE-2020-12757
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease…
9.1
CVE-2025-6000
Arbitrary Remote Code Execution via Plugin Catalog Abuse
9.1
CVE-2022-40186
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3