CVE-2021-3024

Name
CVE-2021-3024
Description
HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* vault >= None < 1.5.7
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* vault >= 1.6.0 < 1.6.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
vault edge-community 1.5.7-r0 None fixed
vault edge-community 1.5.6-r0 None possibly vulnerable
vault edge-community 1.5.4-r0 None possibly vulnerable
vault edge-community 1.4.3-r0 None possibly vulnerable
vault 3.18-community 1.5.7-r0 None fixed
vault 3.17-community 1.5.7-r0 None fixed