What is GHSA-9v3w-w2jh-4hff?

GHSA-9v3w-w2jh-4hff is a security advisory published by GitHub Security Advisories with Medium severity. HashiCorp Vault and Vault Enterprise vulnerable to user enumeration

Which CVE IDs does GHSA-9v3w-w2jh-4hff cover?

GHSA-9v3w-w2jh-4hff covers the following CVE IDs: CVE-2023-3462. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9v3w-w2jh-4hff?

GHSA-9v3w-w2jh-4hff has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-9v3w-w2jh-4hff?

GHSA-9v3w-w2jh-4hff affects 2 products, including: go/github.com/hashicorp/vault:\u003c 1.13.5; go/github.com/hashicorp/vault:= 1.14.0.

GHSA-9v3w-w2jh-4hffMediumCVSS 5.3

HashiCorp Vault and Vault Enterprise vulnerable to user enumeration

Vendor

GitHub Security Advisories

Published

August 1, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-3462 →

📋 Description

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

🎯 Affected products2

go/github.com/hashicorp/vault:< 1.13.5
go/github.com/hashicorp/vault:= 1.14.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-3462
https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714
https://github.com/advisories/GHSA-9v3w-w2jh-4hff