CVE-2021-41802

EUVD-2021-2251
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.9 LOW
ADJACENT_NETWORK
LOW
HIGH
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
mitreCNA
2.9 LOW
ADJACENT_NETWORK
LOW
HIGH
CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:H/S:C/UI:R
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
hashicorpvault
𝑥
< 1.7.5
hashicorpvault
𝑥
< 1.7.5
hashicorpvault
1.8.0 ≤
𝑥
< 1.8.4
hashicorpvault
1.8.0 ≤
𝑥
< 1.8.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation/
https://security.gentoo.org/glsa/202207-01
https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation/
https://security.gentoo.org/glsa/202207-01