CVE-2022-25243

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

• CWE-295

• https://discuss.hashicorp.comVendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-09-vault-pki-secrets-engine-policy-results-in-incorrect-wildcard-certificate-issuance/36600Mitigation, Vendor Advisory
• https://security.gentoo.org/glsa/202207-01Third Party Advisory
• https://discuss.hashicorp.comVendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-09-vault-pki-secrets-engine-policy-results-in-incorrect-wildcard-certificate-issuance/36600Mitigation, Vendor Advisory
• https://security.gentoo.org/glsa/202207-01Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25235xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks cer…9.8
• CVE-2022-25236xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attac…9.8
• CVE-2022-25237Bonita Web 2021.2 is affected by a authentication/authorizat…9.8
• CVE-2022-25238Silverstripe silverstripe/framework through 4.10.0 allows XS…5.4
• CVE-2022-25241In FileCloud before 21.3, the CSV user import functionality …8.8
• CVE-2022-25242In FileCloud before 21.3, file upload is not protected again…8.8
• CVE-2022-25244Vault Enterprise clusters using the tokenization transform f…6.5
• CVE-2022-25245Zoho ManageEngine ServiceDesk Plus before 13001 allows anyon…5.3
• CVE-2022-25246Axeda agent (All versions) and Axeda Desktop Server for Wind…8.8
• CVE-2022-25247Axeda agent (All versions) and Axeda Desktop Server for Wind…9.8
• CVE-2022-25248When connecting to a certain port Axeda agent (All versions)…5.3
• CVE-2022-25249When connecting to a certain port Axeda agent (All versions)…7.5