CVE-2021-41802

Description

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other users policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.254

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-41802 are affected in HashiCorp Vault Enterprise 1.7.4	Windows
Vulnerabilities CVE-2021-41802 are affected in HashiCorp Vault Enterprise 1.8.3	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234