2 lines
2.1 KiB
JSON
2 lines
2.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"0.7.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.21.14","status":"unaffected"}],"lessThan":"2.2.2","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."}],"id":"CVE-2026-93333","lastModified":"2026-11-13T00:20:18.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@hashicorp.com","type":"Secondary"}]},"published":"2026-11-13T00:20:18.883","references":[{"source":"security@hashicorp.com","url":"https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"}],"source":"security@hashicorp.com","type":"Secondary"}]}
|