High severity · published Sep 29, 2023
CVE-2023-5077
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vault · Hashicorp
0.10.0 before 1.13.0; 0.10.0 before 1.13.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5077
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654
More from Vault
9.8
CVE-2024-2048
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate
9.8
CVE-2020-35192
The official vault docker images before 0.11.6 contain a blank password for a root user
9.8
CVE-2020-12757
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease…
9.1
CVE-2025-6000
Arbitrary Remote Code Execution via Plugin Catalog Abuse
9.1
CVE-2022-40186
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3