CVE-2023-0620
Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.
A flaw was found in HashiCorp Vault and Vault Enterprise, which are vulnerable to SQL injection. This flaw allows a local authenticated attacker to send specially-crafted SQL statements to the Microsoft SQL (MSSQL) Database Storage Backend, which could allow the attacker to view, add, modify, or delete information in the backend database.
Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-02-01 CVE Reserved
- 2023-03-30 CVE Published
- 2025-02-13 CVE Updated
- 2025-04-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
- CAPEC-66: SQL Injection
References (4)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20230526-0008 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080/1 | 2023-05-26 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-0620 | 2023-10-31 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2184663 | 2023-10-31 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | < 1.11.9 Search vendor "Hashicorp" for product "Vault" and version " < 1.11.9" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | < 1.11.9 Search vendor "Hashicorp" for product "Vault" and version " < 1.11.9" | enterprise |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.12.0 < 1.12.5 Search vendor "Hashicorp" for product "Vault" and version " >= 1.12.0 < 1.12.5" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.12.0 < 1.12.5 Search vendor "Hashicorp" for product "Vault" and version " >= 1.12.0 < 1.12.5" | enterprise |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.13.0 < 1.13.1 Search vendor "Hashicorp" for product "Vault" and version " >= 1.13.0 < 1.13.1" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.13.0 < 1.13.1 Search vendor "Hashicorp" for product "Vault" and version " >= 1.13.0 < 1.13.1" | enterprise |
Affected
| ||||||