Description (CNA)
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| HashiCorp / Vault | affected 0.10.0 before 2.0.0 |
| HashiCorp / Vault Enterprise | affected 0.10.0 before 2.0.0 |
CWE
CWE-288
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Vault. An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write. This vulnerability can lead to a denial-of-service by allowing the deletion of critical data. It does not permit a malicious user to delete secrets across namespaces or read any secret data.