← Back

CVE-2024-8365

nvd nist
Published: Sep 2, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.

Affected (3)

Products: Hashicorp: Vault
Hashicorp
1 product
Vault
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Vault
Before 1.17.5
Vault
Before 1.16.9
Vault
From 1.17.0 to 1.17.5

Related CWEs

CWE-532
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.