Cyber Resilience

CVE-2023-5077

Hashicorp Vault 0.10.0 – 1.13.0

Published
29 September 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0044 36th percentile
Risk Priority 52 floored blend · peak EPSS

Summary

CVE-2023-5077 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Hashicorp Vault. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
T1574.005 Executable Installer File Permissions Weakness Stealth
Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.
T1574.010 Services File Permissions Weakness Stealth
Adversaries may execute their own malicious payloads by hijacking the binaries used by services.
T1505.005 Terminal Services DLL Persistence
Adversaries may abuse components of Terminal Services to enable persistent access to systems.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-3775Same product: Hashicorp Vault
CVE-2025-5999Same product: Hashicorp Vault
CVE-2023-0665Same product: Hashicorp Vault
CVE-2024-0831Same product: Hashicorp Vault
CVE-2024-2877Same product: Hashicorp Vault
CVE-2024-8365Same product: Hashicorp Vault
CVE-2025-6015Same product: Hashicorp Vault
CVE-2025-6004Same product: Hashicorp Vault
CVE-2025-3879Same product: Hashicorp Vault
CVE-2023-24999Same product: Hashicorp Vault

Affected Assets

hashicorp
vault
0.10.0 — 1.13.0 · 0.10.0 — 1.13.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 15 hardening rules · 9 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-266 CWE-732

Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.

addresses: CWE-266 CWE-732

Ensures privileges are assigned only as necessary rather than incorrectly over-granted.

addresses: CWE-266

Regular reviews catch incorrect privilege assignments to users, roles, or processes.

addresses: CWE-732

Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.

addresses: CWE-266

Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.

addresses: CWE-266

The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.

addresses: CWE-732

Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.

addresses: CWE-732

Training on permission management reduces incorrect permission assignments for critical resources.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.

PR.PS-01 mostly match
prevents

Hardened baselines and configuration management explicitly include correct permission settings for critical resources.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

By requiring owners to determine and document the exact permissions needed for each asset, the control reduces the likelihood that default or overly permissive file and resource permissions will be left in place.

prevents

The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.

prevents

Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.

prevents

Requiring explicit configuration of access controls and permissions for files, applications and services counters the assignment of overly permissive default or incorrect file-system rights.

prevents

Enforcing differentiated permissions on the source-code repository and program listings stops the assignment of overly broad default or inherited permissions to critical resources.

prevents

By defining and enforcing secure permission settings in configuration templates, the control reduces the likelihood that critical resources receive incorrect permission assignments.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248551 A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266
  • V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-732
Oracle Linux 9 (1 rule)
  • V-271779 OL 9 must be configured so that a sticky bit must be set on all public directories. prevents CWE-266
RHEL 8 (1 rule)
  • V-230243 A sticky bit must be set on all RHEL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266
RHEL 9 (1 rule)
  • V-257929 A sticky bit must be set on all RHEL 9 public directories. prevents CWE-266
Ubuntu 22.04 (2 rules)
  • V-260513 Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266
  • V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-266
Ubuntu 24.04 (2 rules)
  • V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-266
  • V-270750 Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources. prevents CWE-266
Windows Server 2016 (2 rules)
  • V-224972 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
  • V-224831 Local volumes must use a format that supports NTFS attributes. prevents CWE-732
Windows Server 2019 (2 rules)
  • V-205741 Windows Server 2019 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
  • V-205663 Windows Server 2019 local volumes must use a format that supports NTFS attributes. prevents CWE-732
Windows Server 2022 (2 rules)
  • V-254393 Windows Server 2022 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
  • V-254250 Windows Server 2022 local volumes must use a format that supports NTFS attributes. prevents CWE-732

References