CVE-2019-12291

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured...

Design/Logic Flaw

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured...

CVE-2019-12291

Removed by vendor...

CVE-2019-12291: Undefined Security Weakness

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured...

PT-2019-12736 · Hashicorp +1 · Hashicorp Consul +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul versions 1.4.0 through 1.5.0 Description: The issue is related to Incorrect Access Control in HashiCorp Consul. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that...

Unauthorised Deletion

github.com/Hashicorp/Consul is vulnerable to unauthorised deletion. It does not prevent deletion of a key which is not matching with a prefix if it uses a specific ACL rule for prefix matching in a policy...