VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 10, 2022· Updated Jun 17, 2026

CVE-2022-25243

CVE-2022-25243

Description

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Hashicorp/Vault3 versions
    cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*+ 2 more
    • cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*range: >=1.8.0,<1.8.9
    • cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*range: >=1.8.0,<1.8.9
    • (no CPE)range: 1.8.0 - 1.8.8, 1.9.3
  • HashiCorp Vault/Vaultdescription
  • Hashicorp/Vault Enterprisellm-fuzzy
    Range: 1.8.0 - 1.8.8, 1.9.3
  • osv-coords
    pkg:bitnami/vault
    Range: >= 1.8.0, < 1.8.9

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.