GHSA-r9w6-rhh9-7v53

Source

https://github.com/advisories/GHSA-r9w6-rhh9-7v53

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-r9w6-rhh9-7v53/GHSA-r9w6-rhh9-7v53.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r9w6-rhh9-7v53

Aliases

Published

2021-07-28T17:57:57Z

Modified

2024-08-21T15:57:33.588064Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Incorrect Authorization in HashiCorp Consul

Details

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Database specific

{
    "nvd_published_at": "2020-01-31T13:15:00Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-07-27T15:08:01Z"
}

References

Affected packages

Go / github.com/hashicorp/consul

Package

Name: github.com/hashicorp/consul; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/consul

Affected ranges

Type: SEMVER
Events: Introduced

1.4.1

Fixed

1.6.3

Database specific

{
    "last_known_affected_version_range": "<= 1.6.2"
}