CVE-2021-41802

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2021-10-08

Last modified

2024-08-04

Weaknesses

CWE-732

Affected products

• Vault (Hashicorp)

References

• https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privil…
• https://security.gentoo.org/glsa/202207-01