BIT-consul-2021-41805

vendorUSosv

view advisory published 2024-03-06Licence: per source

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41805US	high8.8OT high	34.8% (98th)	Exploit	2021-12-12
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-41805WEB
https://security.netapp.com/advisory/ntap-20211229-0007/ADVISORY
https://www.hashicorp.com/blog/category/consulADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan