Medium severity5.3NVD Advisory· Published Jul 31, 2023· Updated Jun 17, 2026
CVE-2023-3462
CVE-2023-3462
Description
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/hashicorp/vaultGo | < 1.13.5 | 1.13.5 |
github.com/hashicorp/vaultGo | >= 1.14.0, < 1.14.1 | 1.14.1 |
Affected products
32cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*+ 4 more
- cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*range: >=1.13.0,<1.13.5
- cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*range: >=1.13.0,<1.13.5
- cpe:2.3:a:hashicorp:vault:1.14.0:*:*:*:-:*:*:*
- cpe:2.3:a:hashicorp:vault:1.14.0:*:*:*:enterprise:*:*:*
- (no CPE)range: 1.13.0
- osv-coords26 versionspkg:apk/chainguard/k3dpkg:apk/chainguard/k3d-proxypkg:apk/chainguard/k3d-toolspkg:apk/chainguard/vault-1.13pkg:apk/chainguard/vault-1.13-compatpkg:apk/chainguard/vault-1.13-entrypointpkg:apk/chainguard/vault-1.14pkg:apk/chainguard/vault-1.14-compatpkg:apk/chainguard/vault-1.14-entrypointpkg:apk/chainguard/vault-1.16pkg:apk/chainguard/vault-1.16-compatpkg:apk/chainguard/vault-fips-1.14pkg:apk/chainguard/vault-fips-1.14-compatpkg:apk/chainguard/vault-fips-1.16pkg:apk/chainguard/vault-fips-1.16-compatpkg:apk/wolfi/k3dpkg:apk/wolfi/k3d-proxypkg:apk/wolfi/k3d-toolspkg:apk/wolfi/vault-1.13pkg:apk/wolfi/vault-1.13-compatpkg:apk/wolfi/vault-1.13-entrypointpkg:apk/wolfi/vault-1.14pkg:apk/wolfi/vault-1.14-compatpkg:apk/wolfi/vault-1.14-entrypointpkg:bitnami/vaultpkg:golang/github.com/hashicorp/vault
< 5.6.0-r11+ 25 more
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 1.13.6-r0
- (no CPE)range: < 1.13.6-r0
- (no CPE)range: < 1.13.6-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 5.6.0-r11
- (no CPE)range: < 1.13.6-r0
- (no CPE)range: < 1.13.6-r0
- (no CPE)range: < 1.13.6-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: >= 1.13.0, < 1.13.5
- (no CPE)range: < 1.13.5
- Range: 1.13.0
Patches
Vulnerability mechanics
References
3- discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-9v3w-w2jh-4hffghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-3462ghsaADVISORY
News mentions
0No linked articles in our index yet.