PT-2023-8746 · Hashicorp+2 · Hashicorp Vault+3
Daniel Abeles
+2
·
Published
2023-03-29
·
Updated
2025-05-26
·
CVE-2023-0620
CVSS v3.1
6.7
Medium
| Vector | AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1
Description
The issue is related to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. Certain parameters are not sanitized when passed to the user-provided MSSQL database, allowing an attacker to modify these parameters and execute a malicious SQL command. This can occur when configuring the MSSQL plugin through the local configuration.
Recommendations
For versions 0.8.0 through 1.13.0, update to version 1.13.1, 1.12.5, or 1.11.9 to resolve the issue.
As a temporary workaround, consider restricting access to the MSSQL Database Storage Backend configuration to minimize the risk of exploitation.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hashicorp Vault
Sql
Red Os
Vault Enterprise