Security Advisory

CVE-2023-3462

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-07-31 22:40:23

Last updated 2024-10-21 18:04:40

Assigner HashiCorp

State PUBLISHED

Description

HashiCorps Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

← Browse all CVEs View on cve.org ↗