Vulnerability Description
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Vault | >= 1.10.0, < 1.10.3 |
References
- https://discuss.hashicorp.comVendor Advisory
- https://security.gentoo.org/glsa/202207-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220629-0006/Third Party Advisory
- https://discuss.hashicorp.comVendor Advisory
- https://security.gentoo.org/glsa/202207-01Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220629-0006/Third Party Advisory
FAQ
What is CVE-2022-30689?
CVE-2022-30689 is a vulnerability with a CVSS score of 5.3 (MEDIUM). HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault ...
How severe is CVE-2022-30689?
CVE-2022-30689 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-30689?
Check the references section above for vendor advisories and patch information. Affected products include: Hashicorp Vault.