GitHub Advisoryadvisory · Go

GHSA-h65h-v7fw-4p38 HashiCorp Consul Incorrect Access Control vulnerability

HIGH Published 2023-06-09 Modified 2023-09-29 Official page ↗
Aliases
CVE-2019-12291
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2023-06-09

Affected packages

• Go github.com/hashicorp/consul: >= 1.4.0, < 1.5.1 → fixed in 1.5.1

Description

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. Specific Go Packages Affected github.com/hashicorp/consul/acl

Related

Alias · CVE (1)

  • CVE-2019-12291 HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References