PT-2023-17999 · Hashicorp+1 · Hashicorp Vault+1

Michal Zaczek · Publicado 2023-06-09 · Atualizado 2025-05-26 · CVE-2023-2121

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hashicorp Vault versions prior to 1.11.11 Hashicorp Vault versions prior to 1.12.7 Hashicorp Vault versions prior to 1.13.3 Hashicorp Vault versions prior to 1.14.0

Description The key-value v2 (kv-v2) diff viewer in Vault allowed HTML injection into the Vault web UI through key values.

Recommendations For versions prior to 1.11.11, update to version 1.11.11 or later. For versions prior to 1.12.7, update to version 1.12.7 or later. For versions prior to 1.13.3, update to version 1.13.3 or later. For versions prior to 1.14.0, update to version 1.14.0 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2025-06183

BIT-VAULT-2023-2121

CVE-2023-2121

GHSA-GQ98-53RQ-QR5H

GO-2023-1849

Produtos afetados

Hashicorp Vault

Red Os

Referências · 12

• https://github.com/hashicorp/vault · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2121 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-vault-2023-2121 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1849 · Aviso do Fabricante
• https://github.com/advisories/GHSA-gq98-53rq-qr5h · Nota
• https://osv.dev/vulnerability/GHSA-gq98-53rq-qr5h · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-2121 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-vault-260525 · Nota
• https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-06183 · Nota de Segurança
• https://t.me/cibsecurity/65108 · Publicação no Telegram
• https://redos.red-soft.ru/support/secure · Nota