Published: 01/05/2023 Updated: 09/06/2023

CVSS v3 Base Score: 2.5 | Impact Score: 1.4 | Exploitability Score: 1

VMScore: 0

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2

Vulnerable Product	Search on Vulmon	Subscribe to Product
hashicorp vault

DescriptionThe MITRE CVE dictionary describes this issue as: HashiCorp Vault Enterprise 1130 up to 1131 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher ...

CWE-326 https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322 https://security.netapp.com/advisory/ntap-20230609-0007/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2023-2197

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-2197

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect