HIGH 8.1 Go
Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation
GHSA-wmg5-g953-qqfw · BIT-vault-2023-24999 · CVE-2023-24999 · GO-2023-1900
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999, has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
Ready to move
Start Securing
Free, no credit card | First findings in minutes