CVE-2023-24999
Last modified
CVE-2023-24999 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Vault | < 1.10.11 |
| Hashicorp | Vault | >= 1.11.0, < 1.11.8 |
| Hashicorp | Vault | >= 1.12.0, < 1.12.4 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-24999?
How severe is CVE-2023-24999?
How do I fix CVE-2023-24999?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-24993A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24994A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24995A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24996A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24997Deserialization of Untrusted Data vulnerability in Apache So…9.8
- CVE-2023-24998Apache Commons FileUpload before 1.5 does not limit the numb…7.5
- CVE-2023-2500The Go Pricing - WordPress Responsive Pricing Tables plugin …8.8
- CVE-2023-25000HashiCorp Vault's implementation of Shamir's secret sharing …4.7
- CVE-2023-25001A maliciously crafted SKP file in Autodesk Navisworks 2023 a…7.8
- CVE-2023-25002A maliciously crafted SKP file in Autodesk products is used …7.8
- CVE-2023-25003A maliciously crafted pskernel.dll file in Autodesk AutoCAD …7.8
- CVE-2023-25004A maliciously crafted pskernel.dll file in Autodesk products…7.8
Are you affected by CVE-2023-24999?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST