Bug 2214237 (CVE-2023-2121) - CVE-2023-2121 hashicorp: html injection into web ui
Summary: CVE-2023-2121 hashicorp: html injection into web ui
Keywords:
Status: NEW
Alias: CVE-2023-2121
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2214480 2214481 2214482 2214483 2214484 2214485 2214486 2214487
Blocks: 2213897
TreeView+ depends on / blocked
 
Reported: 2023-06-12 10:28 UTC by Sandipan Roy
Modified: 2025-03-17 23:44 UTC (History)
10 users (show)

Fixed In Version: vault 1.14.0, vault 1.13.3, vault 1.12.7, vault 1.11.11
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:6832 0 None None None 2023-11-08 18:49:39 UTC

Description Sandipan Roy 2023-06-12 10:28:51 UTC 
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814
Comment 8 errata-xmlrpc 2023-11-08 18:49:38 UTC 
This issue has been addressed in the following products:

  RHODF-4.14-RHEL-9

Via RHSA-2023:6832 https://access.redhat.com/errata/RHSA-2023:6832
Note You need to log in before you can comment on or make changes to this bug.