CVE-2024-2048CWE-295

Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

High · published March 4, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-03-04T19:56Z
EPSS history
Timeline
  • 04 MAR 19:56Z
    Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
    cvelistv5