CGA-6qf6-2cwj-4v55

Published

Last updated

https://images.chainguard.dev/security/CGA-6qf6-2cwj-4v55

Package

vault-fips-1.16

Latest Update

Not affected

Aliases

CVE-2023-2121
GHSA-gq98-53rq-qr5h

Severity

4.3

Medium

CVSS V3

Summary

Hashicorp Vault vulnerable to Cross-site Scripting

Description

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-2121
https://github.com/advisories/GHSA-gq98-53rq-qr5h
https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814
https://github.com/hashicorp/vault

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CGA-6qf6-2cwj-4v55

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources