VDB
CVE-2022-40186
CVE-2022-40186
PUBLISHED
CVSS 9.100000381469727 CRITICAL
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.
EPSS 1.00% · 62.8th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score
1.00%
62.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | vault | 1.8.0, 1.11.0, 1.10.0 |
| Bitnami | vault | 1.8.0, 1.10.0, 1.11.0 |
Timeline
- Sep 20, 2022 CVE Published
- Sep 22, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Dec 22, 2022 EPSS Score
- Feb 6, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 23, 2023 EPSS Score
- May 8, 2023 EPSS Score
- Jun 23, 2023 EPSS Score
- Aug 7, 2023 EPSS Score
- Sep 22, 2023 EPSS Score
- Nov 7, 2023 EPSS Score