CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-9180

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 44.1%

CVSS Severity

CVSS v3 Score 7.2

References

https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565

Products affected by CVE-2024-9180

Hashicorp » Vault » Version: 1.10.0

cpe:2.3:a:hashicorp:vault:1.10.0
Hashicorp » Vault » Version: 1.10.11

cpe:2.3:a:hashicorp:vault:1.10.11
Hashicorp » Vault » Version: 1.10.2

cpe:2.3:a:hashicorp:vault:1.10.2
Hashicorp » Vault » Version: 1.10.3

cpe:2.3:a:hashicorp:vault:1.10.3
Hashicorp » Vault » Version: 1.10.7

cpe:2.3:a:hashicorp:vault:1.10.7
Hashicorp » Vault » Version: 1.11.0

cpe:2.3:a:hashicorp:vault:1.11.0
Hashicorp » Vault » Version: 1.11.3

cpe:2.3:a:hashicorp:vault:1.11.3
Hashicorp » Vault » Version: 1.11.4

cpe:2.3:a:hashicorp:vault:1.11.4
Hashicorp » Vault » Version: 1.11.8

cpe:2.3:a:hashicorp:vault:1.11.8
Hashicorp » Vault » Version: 1.12.0

cpe:2.3:a:hashicorp:vault:1.12.0
Hashicorp » Vault » Version: 1.12.11

cpe:2.3:a:hashicorp:vault:1.12.11
Hashicorp » Vault » Version: 1.12.4

cpe:2.3:a:hashicorp:vault:1.12.4
Hashicorp » Vault » Version: 1.12.8

cpe:2.3:a:hashicorp:vault:1.12.8
Hashicorp » Vault » Version: 1.13.0

cpe:2.3:a:hashicorp:vault:1.13.0
Hashicorp » Vault » Version: 1.13.10

cpe:2.3:a:hashicorp:vault:1.13.10
Hashicorp » Vault » Version: 1.13.4

cpe:2.3:a:hashicorp:vault:1.13.4
Hashicorp » Vault » Version: 1.13.5

cpe:2.3:a:hashicorp:vault:1.13.5
Hashicorp » Vault » Version: 1.13.7

cpe:2.3:a:hashicorp:vault:1.13.7
Hashicorp » Vault » Version: 1.13.8

cpe:2.3:a:hashicorp:vault:1.13.8
Hashicorp » Vault » Version: 1.14.0

cpe:2.3:a:hashicorp:vault:1.14.0
Hashicorp » Vault » Version: 1.14.11

cpe:2.3:a:hashicorp:vault:1.14.11
Hashicorp » Vault » Version: 1.14.12

cpe:2.3:a:hashicorp:vault:1.14.12
Hashicorp » Vault » Version: 1.14.13

cpe:2.3:a:hashicorp:vault:1.14.13
Hashicorp » Vault » Version: 1.14.3

cpe:2.3:a:hashicorp:vault:1.14.3
Hashicorp » Vault » Version: 1.14.4

cpe:2.3:a:hashicorp:vault:1.14.4
Hashicorp » Vault » Version: 1.14.6

cpe:2.3:a:hashicorp:vault:1.14.6
Hashicorp » Vault » Version: 1.15.0

cpe:2.3:a:hashicorp:vault:1.15.0
Hashicorp » Vault » Version: 1.15.10

cpe:2.3:a:hashicorp:vault:1.15.10
Hashicorp » Vault » Version: 1.15.11

cpe:2.3:a:hashicorp:vault:1.15.11
Hashicorp » Vault » Version: 1.15.12

cpe:2.3:a:hashicorp:vault:1.15.12
Hashicorp » Vault » Version: 1.15.13

cpe:2.3:a:hashicorp:vault:1.15.13
Hashicorp » Vault » Version: 1.15.14

cpe:2.3:a:hashicorp:vault:1.15.14
Hashicorp » Vault » Version: 1.15.15

cpe:2.3:a:hashicorp:vault:1.15.15
Hashicorp » Vault » Version: 1.15.16

cpe:2.3:a:hashicorp:vault:1.15.16
Hashicorp » Vault » Version: 1.15.2

cpe:2.3:a:hashicorp:vault:1.15.2
Hashicorp » Vault » Version: 1.15.3

cpe:2.3:a:hashicorp:vault:1.15.3
Hashicorp » Vault » Version: 1.15.4

cpe:2.3:a:hashicorp:vault:1.15.4
Hashicorp » Vault » Version: 1.15.5

cpe:2.3:a:hashicorp:vault:1.15.5
Hashicorp » Vault » Version: 1.15.6

cpe:2.3:a:hashicorp:vault:1.15.6
Hashicorp » Vault » Version: 1.15.7

cpe:2.3:a:hashicorp:vault:1.15.7
Hashicorp » Vault » Version: 1.15.8

cpe:2.3:a:hashicorp:vault:1.15.8
Hashicorp » Vault » Version: 1.15.9

cpe:2.3:a:hashicorp:vault:1.15.9
Hashicorp » Vault » Version: 1.16.0

cpe:2.3:a:hashicorp:vault:1.16.0
Hashicorp » Vault » Version: 1.16.1

cpe:2.3:a:hashicorp:vault:1.16.1
Hashicorp » Vault » Version: 1.16.10

cpe:2.3:a:hashicorp:vault:1.16.10
Hashicorp » Vault » Version: 1.16.11

cpe:2.3:a:hashicorp:vault:1.16.11
Hashicorp » Vault » Version: 1.16.2

cpe:2.3:a:hashicorp:vault:1.16.2
Hashicorp » Vault » Version: 1.16.3

cpe:2.3:a:hashicorp:vault:1.16.3
Hashicorp » Vault » Version: 1.16.4

cpe:2.3:a:hashicorp:vault:1.16.4
Hashicorp » Vault » Version: 1.16.5

cpe:2.3:a:hashicorp:vault:1.16.5
Hashicorp » Vault » Version: 1.16.6

cpe:2.3:a:hashicorp:vault:1.16.6
Hashicorp » Vault » Version: 1.16.7

cpe:2.3:a:hashicorp:vault:1.16.7
Hashicorp » Vault » Version: 1.16.8

cpe:2.3:a:hashicorp:vault:1.16.8
Hashicorp » Vault » Version: 1.16.9

cpe:2.3:a:hashicorp:vault:1.16.9
Hashicorp » Vault » Version: 1.17.0

cpe:2.3:a:hashicorp:vault:1.17.0
Hashicorp » Vault » Version: 1.17.1

cpe:2.3:a:hashicorp:vault:1.17.1
Hashicorp » Vault » Version: 1.17.2

cpe:2.3:a:hashicorp:vault:1.17.2
Hashicorp » Vault » Version: 1.17.3

cpe:2.3:a:hashicorp:vault:1.17.3
Hashicorp » Vault » Version: 1.17.4

cpe:2.3:a:hashicorp:vault:1.17.4
Hashicorp » Vault » Version: 1.17.5

cpe:2.3:a:hashicorp:vault:1.17.5
Hashicorp » Vault » Version: 1.17.6

cpe:2.3:a:hashicorp:vault:1.17.6
Hashicorp » Vault » Version: 1.17.7

cpe:2.3:a:hashicorp:vault:1.17.7
Hashicorp » Vault » Version: 1.7.10

cpe:2.3:a:hashicorp:vault:1.7.10
Hashicorp » Vault » Version: 1.7.7

cpe:2.3:a:hashicorp:vault:1.7.7
Hashicorp » Vault » Version: 1.7.8

cpe:2.3:a:hashicorp:vault:1.7.8
Hashicorp » Vault » Version: 1.7.9

cpe:2.3:a:hashicorp:vault:1.7.9
Hashicorp » Vault » Version: 1.8.0

cpe:2.3:a:hashicorp:vault:1.8.0
Hashicorp » Vault » Version: 1.8.3

cpe:2.3:a:hashicorp:vault:1.8.3
Hashicorp » Vault » Version: 1.8.4

cpe:2.3:a:hashicorp:vault:1.8.4
Hashicorp » Vault » Version: 1.8.6

cpe:2.3:a:hashicorp:vault:1.8.6
Hashicorp » Vault » Version: 1.8.7

cpe:2.3:a:hashicorp:vault:1.8.7
Hashicorp » Vault » Version: 1.8.8

cpe:2.3:a:hashicorp:vault:1.8.8
Hashicorp » Vault » Version: 1.8.9

cpe:2.3:a:hashicorp:vault:1.8.9
Hashicorp » Vault » Version: 1.9.0

cpe:2.3:a:hashicorp:vault:1.9.0
Hashicorp » Vault » Version: 1.9.1

cpe:2.3:a:hashicorp:vault:1.9.1
Hashicorp » Vault » Version: 1.9.10

cpe:2.3:a:hashicorp:vault:1.9.10
Hashicorp » Vault » Version: 1.9.2

cpe:2.3:a:hashicorp:vault:1.9.2
Hashicorp » Vault » Version: 1.9.3

cpe:2.3:a:hashicorp:vault:1.9.3
Hashicorp » Vault » Version: 1.9.4

cpe:2.3:a:hashicorp:vault:1.9.4

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-9180

Products

Pricing

Contact Us