CVE-2023-2197 LOW

CVE-2023-2197: Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM

Vendor Hashicorp
Product Vault Enterprise
Weakness CWE-326 · Weak encryption
Published May 1, 2023
Last update February 13, 2025
View on NVD All CVEs

CVSS base score

2.5/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2

Key dates

02Disclosure timeline

May 1, 2023 CVE published
February 13, 2025 Record updated