Vulnerabilities > Hashicorp > Consul > 1.11.1

DATE CVE VULNERABILITY TITLE RISK
2024-10-30 CVE-2024-10005 Path Traversal vulnerability in Hashicorp Consul
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.
network
low complexity
hashicorp CWE-22
5.8
2024-10-30 CVE-2024-10006 Improper Encoding or Escaping of Output vulnerability in Hashicorp Consul
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.
network
low complexity
hashicorp CWE-116
5.8
2024-10-30 CVE-2024-10086 Cross-site Scripting vulnerability in Hashicorp Consul
A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.
network
low complexity
hashicorp CWE-79
6.1
2023-03-09 CVE-2023-0845 NULL Pointer Dereference vulnerability in Hashicorp Consul
Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances.
network
low complexity
hashicorp CWE-476
6.5
2022-09-23 CVE-2022-40716 Unchecked Return Value vulnerability in Hashicorp Consul
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions.
network
low complexity
hashicorp CWE-252
6.5
2022-09-23 CVE-2021-41803 Missing Authorization vulnerability in Hashicorp Consul
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC.
network
low complexity
hashicorp CWE-862
7.1
2022-04-19 CVE-2022-29153 Server-Side Request Forgery (SSRF) vulnerability in multiple products
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints.
network
low complexity
hashicorp fedoraproject CWE-918
7.5
2022-02-24 CVE-2022-24687 Unspecified vulnerability in Hashicorp Consul
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic.
network
low complexity
hashicorp
6.5