JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
CVE-2023-3518

7.4HIGH

Key Information:

Vendor
Hashicorp
Status
Consul
Consul Enterprise
Vendor
CVE Published:
9 August 2023

Summary

HashiCorp Consul and Consul Enterprise version 1.16.0 presents an issue where the JWT authentication for service mesh incorrectly manages access permissions based on mismatched service identities. This flaw may allow unauthorized access or deny legitimate access to services in the mesh. The vulnerability has been addressed in version 1.16.1, and users are encouraged to upgrade to safeguard against potential exploitation.

Affected Version(s)

Consul 64 bit 1.16.0

Consul Enterprise 64 bit 1.16.0

References

https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-...

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.