CVE-2021-38554 Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Attackers can view secrets cached by the UI in a shared browser, exposing sensitive data to other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38554?
CVE-2021-38554 is a medium-severity vulnerability in Hashicorp Vault, published on 13 Aug 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Weakness: CWE-212
Which versions are affected by CVE-2021-38554?
6 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault Go | All versions | 1.6.6, 1.7.4 |
github.com/hashicorp/vault Go | All versions | 1.6.6 |
github.com/hashicorp/vault Go | All versions | 1.6.6 |
github.com/hashicorp/vault Go | From 1.7.0 | 1.7.4 |
github.com/hashicorp/vault Go | From 1.7.0 | 1.7.4 |
vault Bitnami | All versions | 1.8.0 |
Products include Hashicorp Vault.
How do I fix CVE-2021-38554?
Upgrade github.com/hashicorp/vault to a fixed version for your release line: 1.6.6 or 1.7.4.
Is CVE-2021-38554 being exploited?
There is no known exploitation of CVE-2021-38554 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-vault-2021-38554, GHSA-6239-28c2-9mrm, GO-2022-0632.