Riskcovery

CVE-2023-5077

Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

State
Published
Severity
7.6 High
Published
Sep 28, 2023
Updated
Sep 26, 2024
Reserved
Sep 19, 2023

Read the record on cve.org

Description

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Scores

CVSSScoreVectorSource
3.17.6 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HHashiCorp

Weaknesses

  • CWE-266 Incorrect Privilege Assignment

Affected Products

ProductVersions
VaultHashiCorp
  • 0.10.0 to before 1.13.0Affected
Vault EnterpriseHashiCorp
  • 0.10.0 to before 1.13.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.