CVE-2021-38698 — Missing Authorization in Hashicorp Consul

CWE-862 — Missing AuthorizationCWE-863 — Incorrect Authorization6 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 31.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Hashicorp ConsulHashicorp ConsulDebian Consul
Timeline
PublishedSep 7
Latest updateAug 21

Description

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDhashicorp/consul1.9.0 — 1.9.9+2
▶Gogithub.com/hashicorp_consul1.10.1 — 1.10.2+2
▶debiandebian/consul

🔴Vulnerability Details

4
OSV
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul↗2024-08-21
▶
OSV
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.↗2021-09-08
▶
GHSA
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.↗2021-09-08
▶
OSV
CVE-2021-38698: HashiCorp Consul and Consul Enterprise 1↗2021-09-07
▶

📋Vendor Advisories

1
Debian
CVE-2021-38698: consul - HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed service...↗2021
▶