BIT-consul-2024-10086

vendorUSosv

Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

view advisory published 2024-11-01Licence: per source

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-10086US	medium6.1	0.40% (35th)	—	2024-10-30
A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2024-24-consul-vulnerable-to-reflected-xss-on-content-type-error-manipulationADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-10086WEB
https://security.netapp.com/advisory/ntap-20250110-0006/WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan