CVE-2023-3462
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
| Software | From | Fixed in |
|---|---|---|
github.com/hashicorp/vault
|
- | 1.13.5 |
|
github.com/hashicorp/vault
|
1.14.0 | 1.14.0.x |
|
github.com/hashicorp/vault
|
1.14.0 | 1.14.1 |
| hashicorp / vault | 1.14.0 | 1.14.0.x |
| hashicorp / vault | 1.13.0 | 1.13.5 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime