VDB
CVE-2023-24999
CVE-2023-24999
PUBLISHED
CVSS 8.100000381469727 HIGH
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
EPSS 0.60% · 48.5th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score
0.60%
48.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | vault | 1.11.0, 1.12.0, 0 |
| Bitnami | vault | 0, 1.11.0, 1.12.0 |
Timeline
- Mar 10, 2023 CVE Published
- Mar 11, 2023 EPSS Score
- Mar 11, 2023 PoC Published
- Apr 20, 2023 EPSS Score
- May 30, 2023 EPSS Score
- Jul 6, 2023 CVE Updated
- Jul 9, 2023 EPSS Score
- Aug 17, 2023 EPSS Score
- Sep 26, 2023 EPSS Score
- Nov 5, 2023 EPSS Score
- Dec 15, 2023 EPSS Score
- Jan 24, 2024 EPSS Score