CVE-2021-41805 — Incorrect Authorization in Consul

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
8.8HIGHNVD
EPSS
4.4%
top 10.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Hashicorp ConsulDebian Consul
Timeline
PublishedDec 12
Latest updateDec 13

Description

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDhashicorp/consul1.7.0 — 1.8.17+2
▶debiandebian/consul

🔴Vulnerability Details

2
GHSA
GHSA-crxx-35wq-w63c: HashiCorp Consul Enterprise before 1↗2021-12-13
▶
OSV
CVE-2021-41805: HashiCorp Consul Enterprise before 1↗2021-12-12
▶

📋Vendor Advisories

1
Debian
CVE-2021-41805: consul - HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x befor...↗2021
▶