GHSA-gw2g-hhc9-wgjh

ghsaUSosv

Missing Authorization in HashiCorp Consul

view advisory published 2022-11-16Licence: CC-BY-4.0

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-3920US	high7.5OT elevated	0.72% (54th)	—	2022-11-16
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946WEB
https://github.com/hashicorp/consul/commit/706866fa0016b0aa302679f9c648859050d19b2eWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-3920ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan