PT-2023-17999 · Hashicorp+1 · Hashicorp Vault+1

Michal Zaczek · Published 2023-06-09 · Updated 2025-05-26 · CVE-2023-2121

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hashicorp Vault versions prior to 1.11.11 Hashicorp Vault versions prior to 1.12.7 Hashicorp Vault versions prior to 1.13.3 Hashicorp Vault versions prior to 1.14.0

Description The key-value v2 (kv-v2) diff viewer in Vault allowed HTML injection into the Vault web UI through key values.

Recommendations For versions prior to 1.11.11, update to version 1.11.11 or later. For versions prior to 1.12.7, update to version 1.12.7 or later. For versions prior to 1.13.3, update to version 1.13.3 or later. For versions prior to 1.14.0, update to version 1.14.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06183

BIT-VAULT-2023-2121

CVE-2023-2121

GHSA-GQ98-53RQ-QR5H

GO-2023-1849

Affected Products

Hashicorp Vault

Red Os

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2023-2121 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2023-2121 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1849 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq98-53rq-qr5h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2121 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06183 · Security Note
• https://github.com/hashicorp/vault · Note
• https://github.com/advisories/GHSA-gq98-53rq-qr5h · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-vault-260525 · Note
• https://t.me/cibsecurity/65108 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note