medium5.3
CVE-2021-27668
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication.
Impact
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Vault | from 0.9.2 before 1.6.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427
- https://security.gentoo.org/glsa/202207-01
- https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427
- https://security.gentoo.org/glsa/202207-01