Protocol Switching and Configuration Bypass Vulnerability in Go-Getter by HashiCorp
CVE-2022-26945

9.8CRITICAL

Key Information:

Vendor
Hashicorp
Status
Go-getter
Vendor
CVE Published:
25 May 2022

Summary

The vulnerability in Go-Getter versions up to 1.5.11 and 2.0.2 allows attackers to exploit custom HTTP response header processing. This results in potential protocol switching and an endless redirect loop, leading to unauthorized configuration access. Users are advised to upgrade to versions 1.6.1 and 2.1.0 to mitigate these risks effectively.

References

https://discuss.hashicorp.com
x_refsource_MISC
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vu...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.