CVEvulnerability
CVE-2021-38698
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-09-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-862
Description
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Affected configurations
• hashicorp consul (< 1.8.15)
• hashicorp consul (>= 1.9.0 < 1.9.9)
• hashicorp consul (>= 1.10.0 < 1.10.2)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026 Vendor Advisory
- https://security.gentoo.org/glsa/202208-09 Third Party Advisory
- https://www.hashicorp.com/blog/category/consul Product, Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026 Vendor Advisory
- https://security.gentoo.org/glsa/202208-09 Third Party Advisory
- https://www.hashicorp.com/blog/category/consul Product, Vendor Advisory