Hashicorp Vault Privilege Escalation Vulnerability
Low severity
GitHub Reviewed
Published
Oct 12, 2021
to the GitHub Advisory Database
•
Updated Jan 29, 2023
Package
Affected versions
< 1.7.5
>= 1.8.0, < 1.8.4
Patched versions
1.7.5
1.8.4
Description
Published by the National Vulnerability Database
Oct 8, 2021
Reviewed
Oct 11, 2021
Published to the GitHub Advisory Database
Oct 12, 2021
Last updated
Jan 29, 2023
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
References