PT-2024-6383 · Hashicorp+2 · Hashicorp Vault Enterprise+3

Published 2024-09-02 · Updated 2025-10-01 · CVE-2024-8365

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.17.5 HashiCorp Vault Enterprise versions prior to 1.17.5 and 1.16.9

Description The issue is related to the storage of client tokens and token accessors in plaintext in the audit log due to the removal of functionality that HMAC'd sensitive headers. This could allow a remote attacker to access confidential information.

Recommendations For HashiCorp Vault versions prior to 1.17.5, update to version 1.17.5 or later. For HashiCorp Vault Enterprise versions prior to 1.17.5, update to version 1.17.5 or later. For HashiCorp Vault Enterprise versions prior to 1.16.9, update to version 1.16.9 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

ALT-PU-2025-12480

ALT-PU-2025-12489

BDU:2024-07431

BIT-VAULT-2024-8365

CVE-2024-8365

GHSA-JJXF-26C9-77GM

GO-2024-3113

Affected Products

Alt Linux

Hashicorp Vault

Hashicorp Vault Enterprise

Red Os

References · 13

• https://osv.dev/vulnerability/GHSA-jjxf-26c9-77gm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8365 · Security Note
• https://osv.dev/vulnerability/GO-2024-3113 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2024-8365 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8365 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07431 · Security Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-vault-cve-2024-8365 · Note
• https://twitter.com/VulmonFeeds/status/1830568712832749725 · Twitter Post
• https://t.me/cvedetector/4594 · Telegram Post
• https://github.com/advisories/GHSA-jjxf-26c9-77gm · Note
• https://vuldb.com/?id.276283 · Note