PT-2021-22206 · Hashicorp · Vault Enterprise+1

Avinash Kumar · Published 2021-08-13 · Updated 2024-08-21 · CVE-2021-38554

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions prior to 1.8.0 HashiCorp Vault and Vault Enterprise versions 1.7.x prior to 1.7.4 HashiCorp Vault and Vault Enterprise versions 1.6.x prior to 1.6.6

Description The UI of HashiCorp Vault and Vault Enterprise erroneously cached and exposed user-viewed secrets between sessions in a single shared browser.

Recommendations For versions prior to 1.8.0, update to version 1.8.0 or later. For versions 1.7.x, update to version 1.7.4 or later. For versions 1.6.x, update to version 1.6.6 or later.

Fix

Weakness Enumeration

CWE-212

Related Identifiers

BIT-VAULT-2021-38554

CVE-2021-38554

GHSA-6239-28C2-9MRM

GO-2022-0632

Affected Products

Hashicorp Vault

Vault Enterprise

References · 13

• https://osv.dev/vulnerability/GHSA-6239-28c2-9mrm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38554 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38554 · Security Note
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0632 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2021-38554 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://github.com/hashicorp/vault/releases/tag/v1.6.6 · Note
• https://github.com/hashicorp/vault/releases/tag/v1.7.4 · Note
• https://github.com/advisories/GHSA-6239-28c2-9mrm · Note
• https://t.me/cvenotify/34125 · Telegram Post
• https://t.me/cibsecurity/27326 · Telegram Post