PT-2023-8746 · Hashicorp+2 · Hashicorp Vault+3
Daniel Abeles
+2
·
Publicado
2023-03-29
·
Atualizado
2025-05-26
·
CVE-2023-0620
CVSS v3.1
6.7
Média
| Vetor | AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1
Description
The issue is related to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. Certain parameters are not sanitized when passed to the user-provided MSSQL database, allowing an attacker to modify these parameters and execute a malicious SQL command. This can occur when configuring the MSSQL plugin through the local configuration.
Recommendations
For versions 0.8.0 through 1.13.0, update to version 1.13.1, 1.12.5, or 1.11.9 to resolve the issue.
As a temporary workaround, consider restricting access to the MSSQL Database Storage Backend configuration to minimize the risk of exploitation.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Hashicorp Vault
Sql
Red Os
Vault Enterprise