GitHub Advisoryadvisory · Go

GHSA-r9w6-rhh9-7v53 Incorrect Authorization in HashiCorp Consul

MEDIUM Published 2021-07-28 Modified 2021-07-27 Official page ↗
Aliases
CVE-2020-7955
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2021-07-27

Affected packages

• Go github.com/hashicorp/consul: >= 1.4.1, < 1.6.3 → fixed in 1.6.3

Description

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Related

Alias · CVE (1)

  • CVE-2020-7955 HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References