What is GHSA-6239-28c2-9mrm?

GHSA-6239-28c2-9mrm is a security advisory published by GitHub Security Advisories with Medium severity. Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault

Which CVE IDs does GHSA-6239-28c2-9mrm cover?

GHSA-6239-28c2-9mrm covers the following CVE IDs: CVE-2021-38554. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6239-28c2-9mrm?

GHSA-6239-28c2-9mrm has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6239-28c2-9mrm?

GHSA-6239-28c2-9mrm affects 2 products, including: go/github.com/hashicorp/vault:\u003c 1.6.6; go/github.com/hashicorp/vault:\u003e= 1.7.0, \u003c 1.7.4.

GHSA-6239-28c2-9mrmMediumCVSS 5.3

Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault

Vendor

GitHub Security Advisories

Published

August 30, 2021

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-38554 →

📋 Description

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

🎯 Affected products2

go/github.com/hashicorp/vault:< 1.6.6
go/github.com/hashicorp/vault:>= 1.7.0, < 1.7.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-38554
https://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166
https://github.com/hashicorp/vault/releases/tag/v1.6.6
https://github.com/hashicorp/vault/releases/tag/v1.7.4
https://security.gentoo.org/glsa/202207-01
https://github.com/advisories/GHSA-6239-28c2-9mrm