CVE-2024-10006
Nov. 8, 2024, 6:10 p.m.
Tags
CVSS Score
Products Impacted
| Vendor | Product | Versions |
|---|---|---|
| hashicorp |
|
|
Description
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.
Weaknesses
CWE-116
Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE ID: 116CWE-644
Improper Neutralization of HTTP Headers for Scripting Syntax
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
CWE ID: 644Date
Published: Oct. 30, 2024, 10:15 p.m.
Last Modified: Nov. 8, 2024, 6:10 p.m.
Status : Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@hashicorp.com
CPEs
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | hashicorp | consul | / | / | / | / | community | / | / | / |
| a | hashicorp | consul | / | / | / | / | enterprise | / | / | / |
| a | hashicorp | consul | / | / | / | / | enterprise | / | / | / |
| a | hashicorp | consul | / | / | / | / | enterprise | / | / | / |
| a | hashicorp | consul | 1.20.0 | / | / | / | enterprise | / | / | / |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Base Score
Exploitability Score
Impact Score
Base Severity
MEDIUMCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N