CVE-2023-5077

2023-10-0405:25:17

redhat.com

access.redhat.com

hashicorp

vault

bypassing security

google cloud

secrets engine

iam policy

vulnerability

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

20.6%

JSON

A flaw was found in HashiCorp Vault and Vault Enterprise. This issue could allow a remote authenticated attacker to bypass security restrictions, due to a flaw in the Google Cloud secrets engine when creating or updating rolesets. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the IAM policy.