CVE-2021-38698

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Score

CVSS 3.1 6.5 Medium

Status

Modified - cve@mitre.org

Published

2021-09-07

Last modified

2024-08-04

Weaknesses

CWE-862

Affected products

• Consul (Hashicorp)

References

• https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026
• https://security.gentoo.org/glsa/202208-09
• https://www.hashicorp.com/blog/category/consul