BIT-vault-2024-9180

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/vault/BIT-vault-2024-9180.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-vault-2024-9180
Aliases
Published
2024-10-13T19:17:50.102Z
Modified
2024-10-19T07:38:41.658Z
Summary
[none]
Details

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:hashicorp:vault:*:*:*:*:*:go:*:*",
        "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:go:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / vault

Package

Name
vault
Purl
pkg:bitnami/vault

Severity

  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.7.7
Fixed
1.18.0
Introduced
1.17.0
Fixed
1.17.7
Introduced
1.16.0
Fixed
1.16.11
Introduced
1.7.7
Fixed
1.15.16