Back
CVE-2023-0665
Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
Medium6.5EPSS 0.33%
- Published
- Updated
- Reserved
- Assigned by
- HashiCorp
Description
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| HashiCorpCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.33% · top 73% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
- affected 1.13.0 – < 1.13.1
- affected 1.12.0 – < 1.12.5
- affected 1.11.0 – < 1.11.9
- affected 1.13.0 – < 1.13.1
- affected 1.12.0 – < 1.12.5
- affected 1.11.0 – < 1.11.9
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/hashicorp/vaultGHSA-hwc3-3qh6-r4gg (opens in a new tab)
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-hwc3-3qh6-r4gg (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-0665)Record last updated .