CVE-2023-3462

Published: 2023-07-31T23:15Z

Last Modified: 2024-11-21T08:17Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt