CVE-2022-25244: Medium severity hashicorp vault vulnerability
Published Mar 7, 2022
·Updated
Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10.
Affected Software
3 affected components
HashiCorp Vault>=1.7.0<1.7.10
HashiCorp Vault>=1.8.0<1.8.9
HashiCorp Vault>=1.9.0<1.9.4
Event History
Mar 7, 2022
CVE Published
via MITRE·09:41 PM
Data Sourced
via MITRE·09:41 PM
Description
Frequently Asked Questions
1
What is CVE-2022-25244?
CVE-2022-25244 is a vulnerability in Vault Enterprise clusters using the tokenization transform feature that can expose the tokenization key through the tokenization key configuration endpoint.
2
How does CVE-2022-25244 affect HashiCorp Vault?
CVE-2022-25244 affects HashiCorp Vault Enterprise versions 1.7.0 to 1.7.10, 1.8.0 to 1.8.9, and 1.9.0 to 1.9.4.
3
What is the severity of CVE-2022-25244?
CVE-2022-25244 has a severity rating of medium with a CVSS score of 6.5.
4
How can I fix CVE-2022-25244?
To fix CVE-2022-25244, upgrade to Vault Enterprise version 1.9.4, 1.8.9, or 1.7.10.