Description
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202207-01
Scores
CVSS v3
4.4
EPSS
0.0027
EPSS Percentile
18.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-281
Status
published
Products (2)
hashicorp/vault
1.4.0 - 1.8.0 (2 CPE variants)
hashicorp/vault
1.4.0 - 1.8.0Go
Published
Aug 13, 2021
Tracked Since
Feb 18, 2026