What is GHSA-c5wc-v287-82pc?

GHSA-c5wc-v287-82pc is a security advisory published by GitHub Security Advisories with Medium severity. HashiCorp Vault improper configuration of multi factor authentication

Which CVE IDs does GHSA-c5wc-v287-82pc cover?

GHSA-c5wc-v287-82pc covers the following CVE IDs: CVE-2022-30689. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c5wc-v287-82pc?

GHSA-c5wc-v287-82pc has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-c5wc-v287-82pc?

GHSA-c5wc-v287-82pc affects 1 product, including: go/github.com/hashicorp/vault:\u003e= 1.10.0, \u003c 1.10.3.

GHSA-c5wc-v287-82pcMediumCVSS 5.3

HashiCorp Vault improper configuration of multi factor authentication

Vendor

GitHub Security Advisories

Published

May 18, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2022-30689 →

📋 Description

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.

🎯 Affected products1

go/github.com/hashicorp/vault:>= 1.10.0, < 1.10.3

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-30689
https://github.com/hashicorp/vault/commit/15baea5fa3e71c837c33b8bcbd8f06e0fbbc110d
https://discuss.hashicorp.com
https://security.netapp.com/advisory/ntap-20220629-0006/
https://security.gentoo.org/glsa/202207-01
https://github.com/advisories/GHSA-c5wc-v287-82pc