GHSA-h65h-v7fw-4p38

Suggest an improvement
Source
https://github.com/advisories/GHSA-h65h-v7fw-4p38
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-h65h-v7fw-4p38/GHSA-h65h-v7fw-4p38.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h65h-v7fw-4p38
Aliases
Published
2023-06-09T23:23:42Z
Modified
2023-11-08T04:01:03.380759Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
HashiCorp Consul Incorrect Access Control vulnerability
Details

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.

Specific Go Packages Affected

github.com/hashicorp/consul/acl

References

Affected packages

Go / github.com/hashicorp/consul

Package

Name
github.com/hashicorp/consul
View open source insights on deps.dev
Purl
pkg:golang/github.com/hashicorp/consul

Affected ranges

Type
SEMVER
Events
Introduced
1.4.0
Fixed
1.5.1