ALT-PU-2023-4851-3
Closed vulnerabilities
Published: 2023-07-31
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-3462
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
Severity: MEDIUM (5.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References:
Published: 2023-08-01
Modified: 2023-08-01
Modified: 2023-08-01
GHSA-9v3w-w2jh-4hff
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration
Severity: MEDIUM (5.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References:
Closed bugs
Добавить поддержку пользовательского интерфейса в Vault