CVE-2021-38698

Description

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Affected Platforms

Weakness Type

CWE-862

References

• https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check…
• https://security.gentoo.org/glsa/202208-09
• https://www.hashicorp.com/blog/category/consul
• https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check…
• https://security.gentoo.org/glsa/202208-09
• https://www.hashicorp.com/blog/category/consul