CVE-2022-30689: 
HashiCorp Vault vulnerability analysis and mitigation

HashiCorp Vault and Vault Enterprise versions 1.10.0 through 1.10.2 contained a vulnerability where Multi-Factor Authentication (MFA) was not correctly configured and enforced on login after server restarts. This vulnerability, tracked as CVE-2022-30689, was discovered in May 2022 and specifically affects the Login MFA feature introduced in version 1.10.0, but does not impact the separate Enterprise MFA feature set (NVD, Rapid7).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it is network accessible, requires low attack complexity, and can result in low impact to integrity (NetApp Security).

When successfully exploited, this vulnerability could lead to addition or modification of data by bypassing MFA restrictions after server restarts. The impact is primarily focused on the authentication security controls, potentially allowing unauthorized access to protected resources (NetApp Security).

The vulnerability has been fixed in HashiCorp Vault version 1.10.3. Users are advised to upgrade to this version or later to address the MFA enforcement issue (Gentoo Security).