CVE-2022-3920 Consul Peering Imported Nodes/Services Leak

2022-11-1523:25:30

CWE-862

HashiCorp

www.cve.org

cve-2022-3920

consul

peering

imported nodes

services

leak

hashicorp

http

rpc

endpoint

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.002 Low

EPSS

Percentile

55.4%

JSON

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering’s imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

CNA Affected

[
  {
    "vendor": "HashiCorp",
    "product": "Consul",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "repo": "https://github.com/hashicorp/consul",
    "versions": [
      {
        "status": "affected",
        "version": "1.13.0"
      },
      {
        "status": "affected",
        "version": "1.13.1"
      },
      {
        "status": "affected",
        "version": "1.13.2"
      },
      {
        "status": "affected",
        "version": "1.13.3"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "HashiCorp",
    "product": "Consul Enterprise",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.13.0"
      },
      {
        "status": "affected",
        "version": "1.13.1"
      },
      {
        "status": "affected",
        "version": "1.13.2"
      },
      {
        "status": "affected",
        "version": "1.13.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]