CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

2023-08-0915:06:52

CWE-266

HashiCorp

www.cve.org

cve-2023-3518

jwt auth

l7 intentions

hashicorp consul

consul enterprise

access control

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

31.1%

JSON

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Consul",
    "repo": "https://github.com/hashicorp/consul",
    "vendor": "HashiCorp",
    "versions": [
      {
        "status": "affected",
        "version": "1.16.0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Consul Enterprise",
    "repo": "https://github.com/hashicorp/consul",
    "vendor": "HashiCorp",
    "versions": [
      {
        "status": "affected",
        "version": "1.16.0"
      }
    ]
  }
]