Vulnerability Database
296,138
Total vulnerabilities in the database
CVE-2023-3462
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
| Software | From | Fixed in |
|---|---|---|
github.com/hashicorp/vault
|
- | 1.13.5 |
|
github.com/hashicorp/vault
|
1.14.0 | 1.14.0.x |
|
github.com/hashicorp/vault
|
1.14.0 | 1.14.1 |
| hashicorp / vault | 1.14.0 | 1.14.0.x |
| hashicorp / vault | 1.13.0 | 1.13.5 |