diff --git a/advisories/unreviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json b/advisories/github-reviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json similarity index 56% rename from advisories/unreviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json rename to advisories/github-reviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json index 1fec6331c94..9d6bad6df97 100644 --- a/advisories/unreviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json +++ b/advisories/github-reviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-rr8j-7w34-xp5j", - "modified": "2024-10-10T21:30:43Z", + "modified": "2024-10-10T22:19:11Z", "published": "2024-10-10T21:30:43Z", "aliases": [ "CVE-2024-9180" ], + "summary": "Vault Community Edition privilege escalation vulnerability", "details": "A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/vault" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.18.0" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +47,10 @@ { "type": "WEB", "url": "https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565" + }, + { + "type": "PACKAGE", + "url": "https://github.com/hashicorp/vault" } ], "database_specific": { @@ -31,8 +58,8 @@ "CWE-266" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-10-10T22:19:11Z", "nvd_published_at": "2024-10-10T21:15:05Z" } } \ No newline at end of file