What is CVE-2023-0665?

CVE-2023-0665 is a medium-severity vulnerability in Hashicorp Vault, classified under Improper Authorization. CVSS score: 6.5/10. Published 2023-03-30.

How severe is CVE-2023-0665?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Hashicorp Vault

CVE-2023-0665

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

EPSS: 0.003 (25.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

Affected products

Hashicorp Vault — versions 1.13.0, 1.12.0, 1.11.0
Hashicorp Vault Enterprise — versions 1.13.0, 1.12.0, 1.11.0

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

security@hashicorp.com (Patch, Issue Tracking, Vendor Advisory)
security@hashicorp.com

Frequently asked questions

What is CVE-2023-0665?: CVE-2023-0665 is a medium-severity vulnerability in Hashicorp Vault, classified under Improper Authorization. CVSS score: 6.5/10. Published 2023-03-30.
How severe is CVE-2023-0665?: Medium severity. CVSS v3 base score is 6.5 out of 10.