Lucene search

MitreCVE-2022-36129

HistoryJul 26, 2022 - 11:15 p.m.

CVE-2022-36129

2022-07-2623:15:08

CWE-306

mitre

web.nvd.nist.gov

hashicorp

vault enterprise

api

security

cve-2022-36129

integrated storage

data loss

catastrophic failure

vulnerability

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.

Affected configurations

Nvd

Node

hashicorpvaultRange1.7.0–1.9.7

hashicorpvaultRange1.10.0–1.10.4

hashicorpvaultMatch1.11.0-

hashicorpvaultMatch1.11.0enterprise

VendorProductVersionCPE
hashicorpvault*cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*
hashicorpvault1.11.0cpe:2.3:a:hashicorp:vault:1.11.0:*:*:*:-:*:*:*
hashicorpvault1.11.0cpe:2.3:a:hashicorp:vault:1.11.0:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
hashicorp	vault	*	cpe:2.3:a:hashicorp:vault::::::::
hashicorp	vault	1.11.0	cpe:2.3:a:hashicorp:vault:1.11.0::::-:::
hashicorp	vault	1.11.0	cpe:2.3:a:hashicorp:vault:1.11.0::::enterprise:::

References

discuss.hashicorp.com

discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420

security.netapp.com/advisory/ntap-20220901-0011/

Social References

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

Related for CVE-2022-36129