PT-2024-7690 · Hashicorp+3 · Hashicorp Vault Enterprise+4
Published
2024-10-10
·
Updated
2024-12-28
·
CVE-2024-9180
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
HashiCorp Vault versions prior to 1.18.0
HashiCorp Vault Enterprise versions prior to 1.18.0, 1.17.7, 1.16.11, and 1.15.16
Description
A privileged Vault operator with write permissions to the root namespace’s
identity endpoint could escalate their own or another user’s privileges to Vault’s root policy.Recommendations
For HashiCorp Vault versions prior to 1.18.0, update to Vault Community Edition 1.18.0 or later.
For HashiCorp Vault Enterprise versions prior to 1.18.0, update to Vault Enterprise 1.18.0, 1.17.7, 1.16.11, or 1.15.16.
As a temporary workaround, consider restricting write permissions to the root namespace’s
identity endpoint until a patch is available.Fix
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Hashicorp Vault
Hashicorp Vault Enterprise
Red Os
Suse