CVE-2023-3462

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2023
Source publication: Jul 31, 2023
Source updated: Oct 21, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Vault's LDAP Auth Method Allows for User Enumeration

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Vault

Vendor: HashiCorp
Product: Vault
Platforms: Windows
MacOS
Linux
x86
64 bit
32 bit
ARM
Default status: affected

Vault · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.13.0	`affected`	semver	Unavailable	1.13.4	None listed
1.14.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

Vault Enterprise

Vendor: HashiCorp
Product: Vault Enterprise
Platforms: Windows
MacOS
Linux
x86
ARM
64 bit
32 bit
Default status: unaffected

Vault Enterprise · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.13.0	`affected`	semver	Unavailable	1.13.4	None listed
1.14.0	`affected`	Unavailable	Unavailable	Unavailable	None listed