5.4

CVE-2023-2121: hashicorp vault Cross-site Scripting

CVSS: 5.4v3.1MediumModified
AliasesCGA-4p3w-6w3r-53q8CGA-7q9h-pm53-f72pCGA-c8c3-w444-rxw2
Published 09-06-2023Last modified 06-01-2025
Open JSON

Vulnerability summary

CVE-2023-2121 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in hashicorp vault. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.8% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (NVD)
EPSS score
0.42%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 6
CGA-548R-2P5F-VJ34CGA-6275-53HR-7VXHCGA-6QF6-2CWJ-4V55CGA-82PX-P7VG-J827CGA-RQP2-7FRH-8X2PCGA-VH8W-X5MX-X58P

Timeline

  1. 09-06-2023
    PublishedVulnerability first disclosed.
  2. 06-01-2025
    Last modifiedVulnerability information updated.

Description

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.42%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

0.00 pp

From 0.42% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard5 products
  • k3d< 5.6.0-r11
  • k3d-proxy< 5.6.0-r11
  • k3d-tools< 5.6.0-r11
  • vault-1.16All versions (No fix recorded)
  • vault-1.16-compatAll versions (No fix recorded)
Wolfi3 products
  • k3d< 5.6.0-r11
  • k3d-proxy< 5.6.0-r11
  • k3d-tools< 5.6.0-r11
Hashicorp2 products
  • vault≥ 1.11.0, < 1.11.11 | ≥ 1.10.0, < 1.11.0 | < 1.11.11 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.3
  • vault enterprise≥ 1.13.0, < 1.13.3 | ≥ 1.12.0, < 1.12.7 | ≥ 1.11.0, < 1.11.11 | ≥ 1.10.0, < 1.11.0
Github.com/hashicorp1 product
  • vault< 1.11.11 | ≥ 1.12.0, < 1.12.7 | ≥ 1.13.0, < 1.13.3

4 vendors · 11 products

References

5 links