Bypassing HTTP Request Path-Based Access Rules Through URL Paths in L7 Traffic

CVE-2024-10005

Summary

A vulnerability in Consul and Consul Enterprise allows attackers to bypass HTTP request path-based access controls through the manipulation of URL paths in Layer 7 (L7) traffic intentions. This could lead to unauthorized access to sensitive resources and pose a significant risk to network security. Users are advised to review their access control configurations and apply necessary updates to mitigate potential exploits related to this issue.

References