Missing Authorization Affecting consul package, versions <1.14.1-r0
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Threat Intelligence
EPSS
0.16% (53rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALPINE317-CONSUL-3148108
- published 25 Nov 2022
- disclosed 16 Nov 2022
Introduced: 16 Nov 2022
CVE-2022-3920 Open this link in a new tabHow to fix?
Upgrade Alpine:3.17
consul
to version 1.14.1-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream consul
package and not the consul
package as distributed by Alpine
.
See How to fix?
for Alpine:3.17
relevant fixed versions and status.
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.