Start for Free
MEDIUM 4.3 Go

Hashicorp Vault vulnerable to Cross-site Scripting

GHSA-gq98-53rq-qr5h · BIT-vault-2023-2121 · CVE-2023-2121 · GO-2023-1849

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

References

More Go vulnerabilities

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes