title: Vault’s KV Diff Viewer Allowed for HTML Injection
description: Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
problem types: CWE-79: Improper Neutralization of Input During Web Page Generation
affected:
{
vendor: HashiCorp
product: Vault
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
repo: https://github.com/hashicorp/vault
versions:
status: affected, version: 1.13.0, lessThan: 1.13.3, versionType: semver
status: affected, version: 1.12.0, lessThan: 1.12.7, versionType: semver
status: affected, version: 1.11.0, lessThan: 1.11.11, versionType: semver
status: affected, version: 1.10.0, lessThan: 1.11.0, versionType: semver
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Vault Enterprise
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
versions:
status: affected, version: 1.13.0, lessThan: 1.13.3, versionType: semver
status: affected, version: 1.12.0, lessThan: 1.12.7, versionType: semver
status: affected, version: 1.11.0, lessThan: 1.11.11, versionType: semver
status: affected, version: 1.10.0, lessThan: 1.11.0, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
]