From 5523e8353916951f2cfd25eb2b021d932f315ac9 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 10 Oct 2024 22:20:54 +0000
Subject: [PATCH] Publish GHSA-rr8j-7w34-xp5j

---
 .../GHSA-rr8j-7w34-xp5j.json                  | 35 ++++++++++++++++---
 1 file changed, 31 insertions(+), 4 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json (56%)

diff --git a/advisories/unreviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json b/advisories/github-reviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json
similarity index 56%
rename from advisories/unreviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json
rename to advisories/github-reviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json
index 1fec6331c94..9d6bad6df97 100644
--- a/advisories/unreviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json
+++ b/advisories/github-reviewed/2024/10/GHSA-rr8j-7w34-xp5j/GHSA-rr8j-7w34-xp5j.json
@@ -1,20 +1,43 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rr8j-7w34-xp5j",
-  "modified": "2024-10-10T21:30:43Z",
+  "modified": "2024-10-10T22:19:11Z",
   "published": "2024-10-10T21:30:43Z",
   "aliases": [
     "CVE-2024-9180"
   ],
+  "summary": "Vault Community Edition privilege escalation vulnerability",
   "details": "A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/vault"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.18.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -24,6 +47,10 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/hashicorp/vault"
     }
   ],
   "database_specific": {
@@ -31,8 +58,8 @@
       "CWE-266"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-10T22:19:11Z",
     "nvd_published_at": "2024-10-10T21:15:05Z"
   }
 }
\ No newline at end of file