What is GHSA-wmg5-g953-qqfw?

GHSA-wmg5-g953-qqfw is a security advisory published by GitHub Security Advisories with High severity. Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation

Which CVE IDs does GHSA-wmg5-g953-qqfw cover?

GHSA-wmg5-g953-qqfw covers the following CVE IDs: CVE-2023-24999. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wmg5-g953-qqfw?

GHSA-wmg5-g953-qqfw has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-wmg5-g953-qqfw?

GHSA-wmg5-g953-qqfw affects 3 products, including: go/github.com/hashicorp/vault:\u003c 1.10.11; go/github.com/hashicorp/vault:\u003e= 1.11.0, \u003c 1.11.8; go/github.com/hashicorp/vault:\u003e= 1.12.0, \u003c 1.12.4.

GHSA-wmg5-g953-qqfwHighCVSS 8.1

Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation

Vendor

GitHub Security Advisories

Published

July 6, 2023

Last Modified

July 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-24999 →

📋 Description

When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999, has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

🎯 Affected products3

go/github.com/hashicorp/vault:< 1.10.11
go/github.com/hashicorp/vault:>= 1.11.0, < 1.11.8
go/github.com/hashicorp/vault:>= 1.12.0, < 1.12.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-24999
https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305
https://github.com/advisories/GHSA-wmg5-g953-qqfw