CVE-2022-36129

Katalog CVE

CVSS 9.1 · Critical EPSS 1,6%

Kerentanan Missing Authentication for Critical Function pada hashicorp vault. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.

Rincian

Terbit di NVD

26 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.hashicorp.com advisory vendor
• https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-join... advisory vendor
• https://security.netapp.com/advisory/ntap-20220901-0011/