UpHeron
All vulnerabilities

Servers and applications

CVE-2023-24999

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

Severity
High 8.1
Published
11 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.10.11, 1.11.8, 1.12.4
Sources
NVD

Affected software

SoftwareAffected versions
HashiCorp VaultServers and applications · cpe:a:hashicorp:vault
  • Every version before 1.10.11
  • From 1.11.0 before 1.11.8
  • From 1.12.0 before 1.12.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-24999
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-24999