{"api_version":"1","generated_at":"2026-07-24T04:32:33+00:00","cve":"CVE-2022-30689","urls":{"html":"https://cve.report/CVE-2022-30689","api":"https://cve.report/api/cve/CVE-2022-30689.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-30689","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-30689"},"summary":{"title":"CVE-2022-30689","description":"HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-05-17 18:15:00","updated_at":"2022-12-22 20:23:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://security.netapp.com/advisory/ntap-20220629-0006/","name":"https://security.netapp.com/advisory/ntap-20220629-0006/","refsource":"CONFIRM","tags":[],"title":"CVE-2022-30689 HashiCorp Vulnerability in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://discuss.hashicorp.com","name":"https://discuss.hashicorp.com","refsource":"MISC","tags":[],"title":"HashiCorp Discuss","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/202207-01","name":"GLSA-202207-01","refsource":"GENTOO","tags":[],"title":"HashiCorp Vault: Multiple Vulnerabilities (GLSA 202207-01) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30689","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30689","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"30689","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hashicorp","cpe5":"vault","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"-","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"30689","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hashicorp","cpe5":"vault","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-30689","qid":"710575","title":"Gentoo Linux HashiCorp Vault Multiple Vulnerabilities (GLSA 202207-01)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2022-30689","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://discuss.hashicorp.com","refsource":"MISC","name":"https://discuss.hashicorp.com"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20220629-0006/","url":"https://security.netapp.com/advisory/ntap-20220629-0006/"},{"refsource":"GENTOO","name":"GLSA-202207-01","url":"https://security.gentoo.org/glsa/202207-01"}]}},"nvd":{"publishedDate":"2022-05-17 18:15:00","lastModifiedDate":"2022-12-22 20:23:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.10.0","versionEndExcluding":"1.10.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*","versionStartIncluding":"1.10.0","versionEndExcluding":"1.10.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}