CVE-2021-38554

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

Published: Aug 13, 2021
Updated: May 9, 2024
CVE: CVE-2021-38554
GHSA: GHSA-6239-28c2-9mrm
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.3
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:P/I:N/A:N

CWEs:

CWE-212

Affected Software
References

Software	From	Fixed in
hashicorp / vault	-	1.8.0
github.com/hashicorp/vault	-	1.6.6
github.com/hashicorp/vault	1.7.0	1.7.4

https://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166
https://github.com/hashicorp/vault/releases/tag/v1.6.6
https://github.com/hashicorp/vault/releases/tag/v1.7.4
https://security.gentoo.org/glsa/202207-01

Vulnerability Database

CVE-2021-38554