CVE-2023-2197 - CVE House
Back to Database
Status published Low CVE-2023-2197

Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM

Vulnerability Description

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2197

Credits & Attribution

No credits recorded in the NVD database.

References

More from HashiCorp

View All →
CVE-2025-8959
HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack
High 7.5
CVE-2025-6203
Vault unauthenticated denial of service through complex json payload
High 7.5
CVE-2025-6037
Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates
Medium 6.8
CVE-2025-6015
Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse
Medium 5.7
CVE-2025-6014
Vault TOTP Secrets Engine Code Reuse
Medium 6.5

Affected Vendor

Affected Software

Vault Enterprise
Vulnerable Versions:
1.13.0

Timeline

Official Publish: May 1st, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-326

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.