{"id":"CVE-2023-2121","aliases":["BIT-vault-2023-2121","EUVD-2023-1807","GHSA-gq98-53rq-qr5h","GO-2023-1849"],"status":"published","title":"Vault’s KV Diff Viewer Allowed for HTML Injection","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00417,"percentile":0.36338,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-06-09T16:59:49Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","fixed_in":["1.11.11","1.12.7","1.13.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"vault","fixed_in":["1.11.11","1.12.7","1.13.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.11"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.11"},{"introduced":"1.12.0"},{"fixed":"1.12.7"},{"introduced":"1.13.0"},{"fixed":"1.13.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.11"},{"introduced":"1.12.0"},{"fixed":"1.12.7"},{"introduced":"1.13.0"},{"fixed":"1.13.3"}]}]}],"products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2121","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gq98-53rq-qr5h","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2121.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/vault","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-2121","title":"Vault’s KV Diff Viewer Allowed for HTML Injection","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","status":"published","published":"2023-06-09T16:59:49.065Z","modified":"2025-01-06T18:15:00.958Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:24.004321Z"}],"euvd":[{"id":"EUVD-2023-1807","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","status":"published","published":"2023-06-09T16:59:49Z","modified":"2025-01-06T18:15:00Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:25.578405Z"}],"ghsa":[{"id":"GHSA-gq98-53rq-qr5h","title":"Hashicorp Vault vulnerable to Cross-site Scripting","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","status":"published","published":"2023-06-09T18:30:34Z","modified":"2023-11-06T05:04:30Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2023-2121","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","status":"published","published":"2023-06-09T17:15:09.467Z","modified":"2026-06-17T05:51:27.27Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:05.329837Z"}],"osv":[{"id":"CVE-2023-2121","title":"Vault’s KV Diff Viewer Allowed for HTML Injection","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","status":"published","published":"2023-06-09T16:59:49.065Z","modified":"2026-10-28T02:30:37.190671313Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"GHSA-gq98-53rq-qr5h","title":"Hashicorp Vault vulnerable to Cross-site Scripting","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","status":"published","published":"2023-06-09T18:30:34Z","modified":"2026-09-10T03:49:54.42653008Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"BIT-vault-2023-2121","title":"Vault’s KV Diff Viewer Allowed for HTML Injection","description":"Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.","status":"published","published":"2024-03-06T11:09:28.191Z","modified":"2026-09-08T08:48:21.160472319Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"GO-2023-1849","title":"Hashicorp Vault vulnerable to Cross-site Scripting in github.com/hashicorp/vault","description":"Hashicorp Vault vulnerable to Cross-site Scripting in github.com/hashicorp/vault","status":"published","published":"2024-08-20T20:31:32Z","modified":"2026-02-04T03:04:27.771187Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}