CVE-2024-9180 Vulnerability Details

  /     /     /  

CVE-2024-9180 Metadata Quick Info

CVE Published: 10/10/2024 | CVE Updated: 08/11/2024 | CVE Year: 2024
Source: HashiCorp | Vendor: HashiCorp | Product: Vault
Status : PUBLISHED

---

CVE-2024-9180 Description

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Metrics

CVSS Version: 3.1 | Base Score: 7.2 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-266
CWE Name: CWE-266: Incorrect Privilege Assignment
Source: HashiCorp

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-233
CAPEC Description: CAPEC-233: Privilege Escalation


Source: NVD (National Vulnerability Database).