VULNERABILITY INTELLIGENCE

CVE-2023-0620

CVSS score6.5 MEDIUM
EPSS probability0.38%
CISA KEVNot currently listed
Published2023-03-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.

Weakness classification

  • security@hashicorp.com: CWE-89
  • nvd@nist.gov: CWE-89

Primary references