CVE-2021-42135

Published: 11/10/2021 Updated: 12/07/2022

CVSS v2 Base Score: 4.9 | Impact Score: 4.9 | Exploitability Score: 6.8

CVSS v3 Base Score: 8.1 | Impact Score: 5.2 | Exploitability Score: 2.8

VMScore: 436

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

HashiCorp Vault and Vault Enterprise 1.8.x up to and including 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

Vulnerable Product	Search on Vulmon	Subscribe to Product
hashicorp vault

HashiCorp Vault 18x through 184 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine Users may, in some situations, have more privileges than intended, eg, a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials ...

CWE-269 https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards/https://nvd.nist.gov https://security.archlinux.org/CVE-2021-42135

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-42135

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect