medium6.5
CVE-2021-38698
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
Impact
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Consul | before 1.8.15 from 1.9.0 before 1.9.9 from 1.10.0 before 1.10.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026
- https://security.gentoo.org/glsa/202208-09
- https://www.hashicorp.com/blog/category/consul
- https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026
- https://security.gentoo.org/glsa/202208-09
- https://www.hashicorp.com/blog/category/consul