// For flags

CVE-2022-25243

Gentoo Linux Security Advisory 202207-01

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

Vault y Vault Enterprise versiones 1.8.0 a 1.8.8, y 1.9.3, permitían que el motor de secretos PKI, bajo determinadas configuraciones, emitiera certificados comodín a usuarios autorizados para un dominio especificado, incluso si el atributo de la política de rol PKI allow_subdomains está establecido en falso. Corregido en Vault Enterprise versiones 1.8.9 y 1.9.4

Multiple vulnerabilities have been discovered in HashiCorp Vault, the worst of which could result in denial of service. Versions less than 1.10.3 are affected.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-16 CVE Reserved
  • 2022-03-07 CVE Published
  • 2024-08-03 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hashicorp
Search vendor "Hashicorp"
 Vault
Search vendor "Hashicorp" for product "Vault"
 >= 1.8.0 < 1.8.9
Search vendor "Hashicorp" for product "Vault" and version " >= 1.8.0 < 1.8.9"
-
Affected
Hashicorp
Search vendor "Hashicorp"
 Vault
Search vendor "Hashicorp" for product "Vault"
 >= 1.8.0 < 1.8.9
Search vendor "Hashicorp" for product "Vault" and version " >= 1.8.0 < 1.8.9"
enterprise
Affected
Hashicorp
Search vendor "Hashicorp"
 Vault
Search vendor "Hashicorp" for product "Vault"
 >= 1.9.0 < 1.9.4
Search vendor "Hashicorp" for product "Vault" and version " >= 1.9.0 < 1.9.4"
-
Affected
Hashicorp
Search vendor "Hashicorp"
 Vault
Search vendor "Hashicorp" for product "Vault"
 >= 1.9.0 < 1.9.4
Search vendor "Hashicorp" for product "Vault" and version " >= 1.9.0 < 1.9.4"
enterprise
Affected