PT-2021-17594 · Hashicorp · Hashicorp Vault Enterprise

Published 2021-08-31 · Updated 2024-03-06 · CVE-2021-27668

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Enterprise versions 0.9.2 through 1.6.2

Description The issue allows the read of license metadata from DR secondaries without authentication.

Recommendations For HashiCorp Vault Enterprise versions 0.9.2 through 1.6.2, update to version 1.6.3 to resolve the issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-VAULT-2021-27668

CVE-2021-27668

Affected Products

Hashicorp Vault Enterprise

References · 6

• https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27668 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2021-27668 · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27668 · Vendor Advisory
• https://t.me/cibsecurity/28129 · Telegram Post