CVE-2021-41802 LOW

CVE-2021-41802

Vendor N/A
Product n/a
Published October 8, 2021
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

2.9/10
Attack vector Adjacent
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:H/S:C/UI:R

What the vulnerability does

01Description

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

Key dates

02Disclosure timeline

October 8, 2021 CVE published
August 4, 2024 Record updated