CVE-2021-38554
Published: 13 August 2021
Summary
CVE-2021-38554 is a medium-severity Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212) vulnerability in Hashicorp Vault. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 38.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-1586
Vulnerability details
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Eradication of spilled information from contaminated systems mitigates the effects of improper removal of sensitive data before storage or transfer.
The control requires verified removal of sensitive data before media is made available at a reduced classification level, directly addressing improper removal prior to storage or transfer.
Explicit procedures to delete inaccurate or outdated PII directly mitigate improper removal of sensitive information before storage or transfer.
Retention policies enforce removal or sanitization of sensitive data before storage or transfer per regulatory requirements.
The explicit requirement to delete inaccurate/outdated PII implements proper removal of sensitive information before further storage or transfer.
The control implements proper removal of sensitive information before storage or transfer of datasets.
The generate-on-demand-and-delete requirement enforces removal of sensitive information before storage or transfer, preventing improper retention.
Requires explicit removal of sensitive information prior to component transfer or disposal, reducing exposure from retained data.