PT-2023-21601 · Hashicorp+1 · Hashicorp Consul+2
CVE-2023-2816
·
Publicado
2023-06-02
·
Atualizado
2024-09-26
CVSS v3.1
8.7
Alta
| Vetor | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Consul and Consul Enterprise (affected versions not specified)
Description
The issue allows any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Incorrect Privilege Assignment
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Hashicorp Consul
Hashicorp Consul Enterprise