CVE-2023-2816: falha de alta gravidade em HashiCorp Consul
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.6%
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVEs relacionadas — HashiCorp Consul
No mesmo produto, das mais perigosas para as menos.
CVE-2023-0845MEDIUMConsul Server Panic when Ingress and API Gateways Configured with PeeringEPSS 1.0%CVE-2024-10005HIGHConsul L7 Intentions Vulnerable To URL Path BypassEPSS 0.8%CVE-2023-1297MEDIUM Consul Cluster Peering can Result in Denial of ServiceEPSS 0.8%CVE-2022-3920MEDIUMConsul Peering Imported Nodes/Services LeakEPSS 0.7%CVE-2026-15972HIGHUnauthenticated denial of service via unbounded external gRPC connection acceptanceEPSS 0.5%CVE-2026-2808MEDIUMConsul vulnerable to arbitrary file reads through the vault kubernetes authentication providerEPSS 0.5%