CVE-2024-0831
Assigner: HashiCorp
Published: 2024-02-01T01:41:33.801Z
State: PUBLISHED
title: Vault May Expose Sensitive Information When Configuring An Audit Log Device
problemTypes: descriptions: cweId: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
type: CWE
impacts: capecId: CAPEC-268
descriptions: value: CAPEC-268 Audit Log Manipulation
affected: vendor: HashiCorp
product: Vault
platforms: Windows
MacOS
Linux
x86
ARM
64 bit
32 bit
repo: https://github.com/hashicorp/vault
versions: status: affected
version: 1.15.0
lessThanOrEqual: 1.15.4
versionType: semver
defaultStatus: unaffected
vendor: HashiCorp
product: Vault Enterprise
platforms: Windows
MacOS
Linux
x86
ARM
64 bit
32 bit
versions: status: affected
version: 1.15.0
lessThanOrEqual: 1.15.4
versionType: semver
defaultStatus: unaffected
descriptions: value: Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.
supportingMedia: type: text/html
base64: no
value: <p><span style="background-color: transparent;">Vault and Vault Enterprise (“Vault”) </span><span style="background-color: rgb(255, 255, 255);">may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.</span></p><br><br>
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
source: discovery: INTERNAL