CVE-2023-0690: falha de média gravidade em HashiCorp Boundary
Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5epss 0.4%
HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk.
This issue is fixed in version 0.12.0.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
HashiCorp · BoundaryCVEs relacionadas — HashiCorp Boundary
No mesmo produto, das mais perigosas para as menos.
CVE-2024-12289MEDIUMBoundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceEPSS 0.4%CVE-2024-1052HIGHBoundary Vulnerable to Session Hijacking Through TLS Certificate TamperingEPSS 0.3%CVE-2026-13303HIGHBoundary vulnerable to server-side request forgery in Vault credential storeEPSS 0.2%CVE-2026-7776HIGHBoundary Workers Vulnerable to Denial of Service During TLS HandshakeEPSS 0.2%