HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-38698US | medium6.5OT elevated | — | ||
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9… | ||||
02
references
External citations — patches, advisories, analysis.
- https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026WEB
- https://github.com/hashicorp/consulPACKAGE
- https://github.com/hashicorp/consul/pull/10824WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-38698ADVISORY
- https://security.gentoo.org/glsa/202208-09WEB
- https://www.hashicorp.com/blog/category/consulWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan