SB2022092124 - Information disclosure in HashiCorp Vault

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022092124

SB2022092124 - Information disclosure in HashiCorp Vault

Published: September 21, 2022

Security Bulletin ID SB2022092124
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-40186)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the application permits usage of entity aliases mapped to a single entity share with the same alias name. A local user can create a share with the same alias name as used by another user and wait for the other user to login. After the victim logs in, the attacker will be able to gain access to files metadata in the victim's share.

Successful exploitation of the vulnerability requires that templated ACL policy is enabled and that the policy uses alias.Name, which is derived from the alias name.


Remediation

Install update from vendor's website.

References