CVE-2022-25243

Medium

Description

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

SeverityMedium

CVSS6.5

Exploit probability—

Product

Hashicorp Vault

PublishedMar 10, 2022

First seenMar 10, 2022

How to fix

Update

hashicorp vault1.8.9, 1.9.4 or later

Vendor advisories

security.gentoo.org/glsa/202207-01

Affected products

Product	Affected versions	Fixed in
hashicorp vault	1.8.0 ≤ v < 1.8.9, 1.9.0 ≤ v < 1.9.4	1.8.9, 1.9.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.