CVE-2023-3462
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server.
Risk Assessment
This vulnerability may allow attackers to identify valid user accounts within the organization, increasing the risk of further attacks. It potentially enables data and system security breaches.
Recommendation
It is recommended to upgrade to Vault version 1.14.1 or 1.13.5 to mitigate this vulnerability. Additionally, consider implementing further protective measures against enumeration attacks.
Original NVD description (English source)
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.