Vulnerability Details : CVE-2022-30689
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
Products affected by CVE-2022-30689
- cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*
- cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-30689
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 46 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-30689
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
References for CVE-2022-30689
-
https://security.netapp.com/advisory/ntap-20220629-0006/
CVE-2022-30689 HashiCorp Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://security.gentoo.org/glsa/202207-01
HashiCorp Vault: Multiple Vulnerabilities (GLSA 202207-01) — Gentoo securityThird Party Advisory
-
https://discuss.hashicorp.com
HashiCorp DiscussVendor Advisory
Jump to