CVE-2023-2121: Vault’s KV Diff Viewer Allowed for HTML Injection
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2121.
What is the severity of CVE-2023-2121?
The severity of CVE-2023-2121 is medium with a severity value of 5.4.
Which versions of HashiCorp Vault are affected by CVE-2023-2121?
Versions up to and including 1.11.11, 1.12.0 up to and including 1.12.7, and 1.13.0 up to and including 1.13.3 of HashiCorp Vault are affected by CVE-2023-2121.
How can I fix CVE-2023-2121?
CVE-2023-2121 can be fixed by upgrading to Vault 1.14.0, 1.13.3, 1.12.7, or 1.11.11.
Is there any additional reference for CVE-2023-2121?
Yes, you can find more information about CVE-2023-2121 at the following link: [Link](https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814)