Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2022-3920

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

VectorNETWORK

PublishedNov 16, 2022, 00:15

Published Bysecurity@hashicorp.com

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/hashicorp/consul(Go)1.13.01.14.0N/A

References

https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946

Weakness Type

CWE-862

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK