GitHub Advisoryadvisory · Go

GHSA-fhm8-cxcv-pwvc HashiCorp Consul Access Restriction Bypass

HIGH Published 2022-05-13 Modified 2023-09-28 Official page ↗
Aliases
CVE-2019-8336
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2023-07-19

Affected packages

• Go github.com/hashicorp/consul: >= 1.4.0, < 1.4.3 → fixed in 1.4.3

Description

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "" as its secret is used in unusual circumstances.

Related

Alias · CVE (1)

  • CVE-2019-8336 HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References