6.5

CVE-2022-25243

EPSS 0.25%
Published 10.03.2022 17:47:06
Last modified 21.11.2024 06:51:51
Source cve@mitre.org
Teams watchlist Login
Open Login

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Hashicorp ≫ Vault SwEdition- Version >= 1.8.0 < 1.8.9

Hashicorp ≫ Vault SwEditionenterprise Version >= 1.8.0 < 1.8.9

Hashicorp ≫ Vault SwEdition- Version >= 1.9.0 < 1.9.4

Hashicorp ≫ Vault SwEditionenterprise Version >= 1.9.0 < 1.9.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.25%	0.478

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	3.5	6.8	2.9	AV:N/AC:M/Au:S/C:N/I:P/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://security.gentoo.org/glsa/202207-01

Third Party Advisory

https://discuss.hashicorp.com

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2022-09-vault-pki-secrets-engine-policy-results-in-incorrect-wildcard-certificate-issuance/36600

Vendor Advisory

Mitigation

https://nvd.nist.gov/vuln/detail/CVE-2022-25243

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-25243

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-25243

EUVD