OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpenbao
APPOpenbao< 2.3.2
Powiązane podatności
XSS w OpenBao — kradzież tokenu Web UI przez parametr error_description
OpenBao: zdalne phishing przez JWT/OIDC bez potwierdzenia logowania
OpenBao: ominięcie restrykcji przez subsystem audytu — RCE i dostęp sieciowy
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged opera...
OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON o...