Missing Authorization Affecting github.com/hashicorp/consul/agent package, versions <1.20.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMHASHICORPCONSULAGENT-8602120
- published20 Jan 2025
- disclosed6 Jan 2025
- creditUnknown
Introduced: 6 Jan 2025
New CVE NOT AVAILABLE CWE-862 Â (opens in a new tab)How to fix?
Upgrade github.com/hashicorp/consul/agent to version 1.20.2 or higher.
Overview
github.com/hashicorp/consul/agent is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.
Affected versions of this package are vulnerable to Missing Authorization when processing bexpr filter requests. Authorization checks are performed after the filter is applied, which allows a user to expose what resources exist despite their further access to them being blocked.