CVE-2023-24999

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-25008.8The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and inclu CVE-2023-250004.7HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An a CVE-2023-250017.8A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vu CVE-2023-250027.8A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may CVE-2023-250037.8A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnera CVE-2023-250047.8A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vuln CVE-2023-250057.8A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL CVE-2023-250067.8A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in cod CVE-2023-250077.8A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code exec CVE-2023-250087.8A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result i CVE-2023-250097.8A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result CVE-2023-250107.8A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exe