Cross-Site Scripting Vulnerability in HashiCorp Consul and Consul Enterprise
CVE-2020-25864

6.1MEDIUM

Key Information:

Vendor
Hashicorp
Status
Consul
Vendor
CVE Published:
20 April 2021

Summary

The key-value (KV) raw mode in HashiCorp Consul and Consul Enterprise prior to version 1.9.5 is susceptible to cross-site scripting vulnerabilities, which may allow attackers to inject malicious scripts into web applications. This poses a significant risk, enabling unauthorized actions and data theft. Users are advised to upgrade to versions 1.9.5, 1.8.10, or 1.7.14 to mitigate these security concerns.

References

https://www.hashicorp.com/blog/category/consul
x_refsource_MISC
https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-...
x_refsource_MISC
https://security.gentoo.org/glsa/202208-09
vendor-advisoryx_refsource_GENTOO

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.