Vulnerabilities

TI-2023-00587 CVE-2023-0620 · GHSA-v3hp-mcj5-pg39

Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend

LOW 32

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00378 Published 2023-03-30 Partial fix · 1.13.1, 1.12.5 +1 CWE-89

TI-2023-00630 CVE-2023-0665 · GHSA-hwc3-3qh6-r4gg

Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

LOW 35

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2023-03-30 Partial fix · 1.13.1, 1.12.5 +1 CWE-285

Vulnerabilities

Filters

Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend

Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata