Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-9180

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Published

2024-10-10T21:15:05.010

Last Modified

2024-10-18T20:15:03.393

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.2 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-266
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hashicorp vault ≤ 1.17.7 Yes
Application hashicorp vault < 1.18.0 Yes
Application hashicorp vault < 1.15.16 Yes
Application hashicorp vault < 1.16.11 Yes
References