CVE-2023-3462CWE-203

Vault's LDAP Auth Method Allows for User Enumeration

Medium · published July 31, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
48.7
In the wild
Unconfirmed
What it is

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00613 · 48.7th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2023-07-31T22:40Z
EPSS history
Timeline
  • 31 JUL 22:40Z
    Vault's LDAP Auth Method Allows for User Enumeration
    cvelistv5