high8.8
CVE-2021-41805
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control.
Impact
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Consul | from 1.7.0 before 1.8.17 from 1.9.0 before 1.9.11 from 1.10.0 before 1.10.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871
- https://security.netapp.com/advisory/ntap-20211229-0007/
- https://www.hashicorp.com/blog/category/consul
- https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871
- https://security.netapp.com/advisory/ntap-20211229-0007/
- https://www.hashicorp.com/blog/category/consul