CVE-2021-27668
MEDIUMHashiCorp Vault Enterprise <1.6.2 - Info Disclosure
Title source: llmDescription
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202207-01
Scores
CVSS v3
5.3
EPSS
0.0033
EPSS Percentile
55.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-306
Status
published
Products (1)
hashicorp/vault
0.9.2 - 1.6.3
Published
Aug 31, 2021
Tracked Since
Feb 18, 2026