The vulnerability of the Consul Community Edition and Consul Enterprise configuration tools lies in their failure to remove HTTP headers from script syntax, allowing attackers to gain access to confidential information.

The vulnerability of the Consul service configuration tool lies in the lack of measures taken to neutralize HTTP headers in script syntax. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential information through a specially crafted HTTP reques...

ROS-20241112-09

A vulnerability in the Consul service configuration tool is related to input validation errors when processing catalog traversal sequences. Exploitation of the vulnerability could allow an attacker acting remotely to send a specially crafted HTTP request and read arbitrary files on the system...

Improper Access Control

github.com/hashicorp/consul is vulnerable to Improper Access Control. The vulnerability is due to the ability to bypass HTTP header-based access rules when using headers in L7 traffic intentions, allowing unauthorized access in certain cases...

Cross-site Scripting (XSS)

github.com/hashicorp/consul is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the server's failure to explicitly set a Content-Type HTTP header in the response, allowing user-provided inputs to be misinterpreted, which can lead to reflected XSS attacks...

Path Traversal

github.com/hashicorp/consul is vulnerable to Path Traversal. The vulnerability is due to the bypass of HTTP request path-based access rules when using URL paths in L7 traffic intentions, allowing unauthorized access in specific scenarios...

SUSE CVE-2024-10086

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS...

GO-2024-3242 Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul

Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul...

GO-2024-3243 Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul

Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul...

GO-2024-3241 Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul...

BIT-CONSUL-2024-10005 Consul L7 Intentions Vulnerable To URL Path Bypass

A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules...

BIT-CONSUL-2024-10006 Consul L7 Intentions Vulnerable To Headers Bypass

A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using Headers in L7 traffic intentions could bypass HTTP header based access rules...

BIT-CONSUL-2024-10086 Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS...

CVE-2024-10006

A flaw was found in HashiCorp Consul and Consul Enterprise. The server response does not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and can lead to reflected cross-site scripting XSS. Mitigation Mitigation for this issue is either not available o...

CVE-2024-10005

A vulnerability was found in HashiCorp Consul. Due to a lack of path normalization, URL paths in L7 traffic intentions can be exploited to bypass permissions defined in the intentions. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

CVE-2024-10086

A flaw was found in Consul and Consul Enterprise. This vulnerability allows reflected Cross-site scripting XSS attacks via missing Content-Type HTTP header in server responses, enabling misinterpretation of user-provided inputs. Mitigation Mitigation for this issue is either not available or the...

GHSA-99WR-C2PX-GRMH Hashicorp Consul Cross-site Scripting vulnerability

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS...

GHSA-CHGM-7R52-WHJJ Hashicorp Consul Path Traversal vulnerability

A vulnerability was identified in Consul and Consul Enterprise "Consul" such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules...

GHSA-5C4W-8HHH-3C3H Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability

A vulnerability was identified in Consul and Consul Enterprise "Consul" such that using Headers in L7 traffic intentions could bypass HTTP header based access rules...

Hashicorp Consul Cross-site Scripting vulnerability

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS...

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability

A vulnerability was identified in Consul and Consul Enterprise "Consul" such that using Headers in L7 traffic intentions could bypass HTTP header based access rules...