CVE-2024-0831

Published: Feb 1, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.

Affected (2)

Products: Hashicorp: Vault

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Vault	From 1.15.0 to 1.15.5
Hashicorp Vault	From 1.15.0 to 1.15.5

Related CWEs

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (6)

https://developer.hashicorp.com/vault/docs/upgrading/upgrade-to-1.15.x#audit-devices-could-log-raw-data-despite-configuration

Source: security@hashicorp.com

ExploitVendor Advisory

https://discuss.hashicorp.com/t/hcsec-2024-01-vault-may-expose-sensitive-information-when-configuring-an-audit-log-device/62311

Source: security@hashicorp.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240223-0005/

Source: security@hashicorp.com

https://developer.hashicorp.com/vault/docs/upgrading/upgrade-to-1.15.x#audit-devices-could-log-raw-data-despite-configuration

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

https://discuss.hashicorp.com/t/hcsec-2024-01-vault-may-expose-sensitive-information-when-configuring-an-audit-log-device/62311

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240223-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.