PT-2024-15850 · Hashicorp · Hashicorp Vault

Published 2024-02-01 · Updated 2024-06-28 · CVE-2024-0831

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hashicorp Vault (affected versions not specified)

Description The issue concerns the exposure of sensitive information when an audit device with the log raw option is enabled. This may cause sensitive information to be logged to other audit devices, regardless of their configuration regarding the log raw option.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-VAULT-2024-0831

CVE-2024-0831

GHSA-VGH3-MWXQ-RCP8

GO-2024-2511

Affected Products

Hashicorp Vault

References · 13

• 🔥 https://developer.hashicorp.com/vault/docs/upgrading/upgrade-to-1.15.x#audit-devices-could-log-raw-data-despite-configuration · Exploit
• https://osv.dev/vulnerability/GO-2024-2511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0831 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2024-01-vault-may-expose-sensitive-information-when-configuring-an-audit-log-device/62311 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2024-0831 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgh3-mwxq-rcp8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0831 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://github.com/hashicorp/vault/commit/2a72f2a8a5b57de88c22a2a94c4a5f08c6f3770b · Note
• https://t.me/cvenotify/70818 · Telegram Post
• https://github.com/advisories/GHSA-vgh3-mwxq-rcp8 · Note
• https://security.netapp.com/advisory/ntap-20240223-0005 · Note
• https://t.me/cvenotify/69485 · Telegram Post