CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3114 – Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool
https://notcve.org/view.php?id=CVE-2023-3114
22 Jun 2023 — Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1. • https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329 • CWE-266: Incorrect Privilege Assignment CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2121 – Vault’s KV Diff Viewer Allowed for HTML Injection
https://notcve.org/view.php?id=CVE-2023-2121
09 Jun 2023 — Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. A flaw was found in HashiCorp Vault and Vault Enterprise, where they are vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the key-value v2 (kv-v2) diff viewer. A remote, authenticated attacker can inject malicious script into a Web page which wo... • https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-1297 – Consul Cluster Peering can Result in Denial of Service
https://notcve.org/view.php?id=CVE-2023-1297
02 Jun 2023 — Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3 Multiple vulnerabilities have been discovered in HashiCorp Consul, the worst of which could result in denial of service. Versions greater than or equal to 1.15.10 are affected. • https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515 • CWE-826: Premature Release of Resource During Expected Lifetime •
CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 0CVE-2023-2816 – Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
https://notcve.org/view.php?id=CVE-2023-2816
02 Jun 2023 — Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies. Multiple vulnerabilities have been discovered in HashiCorp Consul, the worst of which could result in denial of service. Versions greater than or equal to 1.15.10 are affected. • https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525 • CWE-266: Incorrect Privilege Assignment CWE-284: Improper Access Control •
CVSS: 2.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2197 – Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM
https://notcve.org/view.php?id=CVE-2023-2197
01 May 2023 — HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2 HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC enc... • https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322 • CWE-326: Inadequate Encryption Strength •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-1782 – Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-1782
05 Apr 2023 — HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3. • https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375 • CWE-862: Missing Authorization •
CVSS: 6.7EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0620 – Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend
https://notcve.org/view.php?id=CVE-2023-0620
30 Mar 2023 — HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9. A flaw was found in HashiCorp Vault and Vault Enterprise, w... • https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0665 – Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
https://notcve.org/view.php?id=CVE-2023-0665
30 Mar 2023 — HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9. A flaw was found in the Hashicorp vault. Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in a de... • https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1 • CWE-285: Improper Authorization •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-25000 – Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
https://notcve.org/view.php?id=CVE-2023-25000
30 Mar 2023 — HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9. A flaw was found in the Hashicorp vault. This flaw allows an attacker with access to and the ability to observe a large numbe... • https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078 • CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-1299 – Nomad Job Submitter Privilege Escalation Using Workload Identity
https://notcve.org/view.php?id=CVE-2023-1299
14 Mar 2023 — HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1. • https://discuss.hashicorp.com/t/hcsec-2023-08-nomad-job-submitter-privilege-escalation-using-workload-identity/51389 • CWE-862: Missing Authorization •