CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2023-3462
Medium (5.3) in hashicorp vault. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/vault 1.13.5, 1.14.1.
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-11-01)
- CWE
- CWE-203
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:vault
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9v3w-w2jh-4hff | Go | github.com/hashicorp/vault | <1.13.5 | 1.13.5 |
| GHSA-9v3w-w2jh-4hff | Go | github.com/hashicorp/vault | >=1.14.0 <1.14.1 | 1.14.1 |
| GO-2023-1986 | Go | github.com/hashicorp/vault | <1.13.5 >=1.14.0 <1.14.1 | 1.13.5, 1.14.1 |