CVE-2022-40186

criticalPriorität · verfolgen · 36EPSS 0.010 · 63. PerzentilDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.00% (63rd) EPSS
CVSS 9.1 · critical
Is it mine?
123 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenodf4/rook-ceph-rhel8-operator@sha256:0b5c88cc500485c0cad5b271ca832c2e46627047e4fe2f0c01ebfa0b161700b5_s390x as a component of RHODF 4.11 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2023
  • Behobenodf4/rook-ceph-rhel8-operator@sha256:31f0ee81d1ac4e98baa7da2a16348e4dd2d30bddf31ff874fa90f9b5a49c5bba_ppc64le as a component of RHODF 4.11 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2023
  • Behobenodf4/rook-ceph-rhel8-operator@sha256:a694abecc595d40399b3333db95ccf570107b213a30da9e572f1ac430ce8400b_amd64 as a component of RHODF 4.11 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2023
  • Behobenodf4/rook-ceph-rhel9-operator@sha256:0b5c88cc500485c0cad5b271ca832c2e46627047e4fe2f0c01ebfa0b161700b5_s390x as a component of RHODF 4.11 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2023
  • Behobenodf4/rook-ceph-rhel9-operator@sha256:31f0ee81d1ac4e98baa7da2a16348e4dd2d30bddf31ff874fa90f9b5a49c5bba_ppc64le as a component of RHODF 4.11 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2023
  • Behobenodf4/rook-ceph-rhel9-operator@sha256:a694abecc595d40399b3333db95ccf570107b213a30da9e572f1ac430ce8400b_amd64 as a component of RHODF 4.11 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2023:2023
02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.3–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.2
v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NsecondaryAusnutzbarkeit 3.9 · Auswirkung 5.2
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Red Hat Product Security US
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-264USCWE-639USCWE-639US
05

betroffene Produkte (123)

Betroffene Produkte und Versionsbereiche.

20 von 123 angezeigt
06

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2023:2023Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.11.7 Bug Fix and security update2023-04-26csaf · redhat_csafUS

    Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.11.7 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2022-1485Hashicorp Vault: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2022-09-20csaf · cert_bundDE

    Ein Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Informationen offenzulegen.

  • GHSA-7cgv-v83v-rr87HashiCorp Vault vulnerable to incorrect metadata access2022-09-23ghsa · osvUS

    An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.

  • BIT-vault-2022-401862024-03-06vendor · osvUS

    An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.

  • GO-2022-1021HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault2024-08-21vendor · osvUS

    HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault

07

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdredhat_csafNVDCVE.orgMITRE
veröffentlicht 2022-09-22geändert 2026-06-17
09

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan