PT-2022-20232 · Hashicorp · Vault Enterprise+1

Published 2022-05-17 · Updated 2024-08-21 · CVE-2022-30689

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions 1.10.0 through 1.10.2

Description The issue is related to the improper configuration and enforcement of multi-factor authentication (MFA) on login after server restarts, specifically affecting the Login MFA feature introduced in versions 1.10.0 of HashiCorp Vault and Vault Enterprise. This does not affect the separate Enterprise MFA feature set. The problem was fixed in version 1.10.3.

Recommendations For HashiCorp Vault and Vault Enterprise versions 1.10.0 through 1.10.2, update to version 1.10.3 to resolve the issue.

Fix

Related Identifiers

BIT-VAULT-2022-30689

CVE-2022-30689

GHSA-C5WC-V287-82PC

GO-2022-0590

Affected Products

Hashicorp Vault

Vault Enterprise

References · 12

• https://osv.dev/vulnerability/GHSA-c5wc-v287-82pc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30689 · Security Note
• https://discuss.hashicorp.com · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30689 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2022-30689 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0590 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://github.com/hashicorp/vault/commit/15baea5fa3e71c837c33b8bcbd8f06e0fbbc110d · Note
• https://github.com/advisories/GHSA-c5wc-v287-82pc · Note
• https://t.me/cibsecurity/42860 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220629-0006 · Note