UpHeron
All vulnerabilities

Servers and applications

CVE-2022-25243

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

Severity
Medium 6.5
Published
10 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.8.9, 1.9.4
Sources
NVD

Affected software

SoftwareAffected versions
HashiCorp VaultServers and applications · cpe:a:hashicorp:vault
  • From 1.8.0 before 1.8.9
  • From 1.9.0 before 1.9.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-25243
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-25243