CVE-2021-38553

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

Published: Aug 13, 2021
Updated: May 9, 2024
CVE: CVE-2021-38553
GHSA: GHSA-23fq-q7hc-993r
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.4
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 2.1
AV:L/AC:L/Au:N/C:N/I:N/A:P

CWEs:

CWE-281

Affected Software
References

Software	From	Fixed in
hashicorp / vault	1.4.0	1.8.0
github.com/hashicorp/vault	1.4.0	1.8.0

https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168
https://security.gentoo.org/glsa/202207-01

Vulnerability Database

CVE-2021-38553