GitHub Advisoryadvisory · Go

GHSA-gw2g-hhc9-wgjh Missing Authorization in HashiCorp Consul

HIGH Published 2022-11-16 Modified 2022-11-21 Official page ↗
Aliases
CVE-2022-3920
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862
Reviewed
2022-11-21

Affected packages

• Go github.com/hashicorp/consul: >= 1.13.0, < 1.14.0 → fixed in 1.14.0

Description

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

Related

Alias · CVE (1)

  • CVE-2022-3920 HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References