CVE-2021-38553

Description

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

References

https://github.com/advisories/GHSA-23fq-q7hc-993r

https://security.gentoo.org/glsa/202207-01

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1503

https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS