CVE-2022-30689
HashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault
5.3
MEDIUM
CVSS 3.1
EPSS 0.36%
Description
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
How to fix CVE-2022-30689
To remediate CVE-2022-30689, upgrade the affected package to a fixed version below.
- —upgrade to 1.10.3 or later
- —upgrade to 1.10.3 or later
- —upgrade to 1.10.3 or later
Is CVE-2022-30689 being exploited?
Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- >= 1.10.0, < 1.10.3
- >= 1.10.0, < 1.10.3
- >= 1.10.0, < 1.10.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |