VDB
CVE-2023-24999
CVE-2023-24999
PUBLISHED
CVSS 8.100000381469727 HIGH
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
EPSS 0.60% · 46.7th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score
0.60%
46.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | vault | 1.11.0, 1.12.0, 0 |
| Bitnami | vault | 0, 1.11.0, 1.12.0 |
Timeline
- Mar 10, 2023 CVE Published
- Mar 11, 2023 EPSS Score
- Mar 11, 2023 PoC Published
- Apr 19, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 7, 2023 EPSS Score
- Aug 15, 2023 EPSS Score
- Sep 23, 2023 EPSS Score
- Nov 1, 2023 EPSS Score
- Dec 10, 2023 EPSS Score
- Jan 18, 2024 EPSS Score
- Feb 27, 2024 EPSS Score