CVE-2024-2877
Assigner: HashiCorp
Published: 2024-04-30T14:58:09.735Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: 64 bit
32 bit
x86
ARM
MacOS
Windows
Linux
product: Vault Enterprise
vendor: HashiCorp
versions: lessThan: 1.15.8
status: affected
version: 1.15.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: <p>Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext.

This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.</p><br/>
value: Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext.

This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.
impacts: capecId: CAPEC-215
descriptions: value: CAPEC-215: Fuzzing for application mapping
metrics: cvssV3_1: baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
type: CWE
source: advisory: HCSEC-2024-10
discovery: INTERNAL
title: Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node