GHSA-r9w6-rhh9-7v53

ghsaUSosv

Incorrect Authorization in HashiCorp Consul

view advisory published 2021-07-28Licence: CC-BY-4.0

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-7955US	medium5.3OT elevated	1.41% (73rd)	—	2020-01-31
HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed…

references

External citations — patches, advisories, analysis.

https://github.com/hashicorp/consul/issues/7160WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-7955ADVISORY
https://www.hashicorp.com/blog/category/consulWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan