VDB
CVE-2024-8365
CVE-2024-8365
PUBLISHED
CVSS 6.5 MEDIUM
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.
EPSS 0.46% · 38.5th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
0.46%
38.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | vault | 1.16.7, 1.17.3 |
| Bitnami | vault | 1.16.7, 1.17.3 |
Timeline
- Sep 1, 2024 CVE Published
- Sep 2, 2024 EPSS Score
- Sep 2, 2024 PoC Published
- Sep 23, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 14, 2024 EPSS Score
- Nov 4, 2024 EPSS Score
- Nov 25, 2024 EPSS Score
- Dec 17, 2024 EPSS Score
- Jan 7, 2025 EPSS Score
- Jan 28, 2025 EPSS Score
- Feb 17, 2025 EPSS Score