Information Disclosure

2022-11-1706:57:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

information disclosure

acls

ui nodes

access

sensitive information

github.com/hashicorp/consul

0.002 Low

EPSS

Percentile

55.2%

JSON

github.com/hashicorp/consul is vulnerable to information disclosure. The vulnerability exists in Filter function of filter.go because the data imported from peers is not properly filtered by ACLs at the UI Nodes which allows an attacker to gain access to the ACL tokens and view sensitive information.

CPENameOperatorVersion
github.com/hashicorp/consuleqsdk/v0.11.0
github.com/hashicorp/consulleapi/v1.15.3
github.com/hashicorp/consullev1.14.0-beta1
github.com/hashicorp/consulleproto-public/v0.1.1
github.com/hashicorp/consuleqsdk/v0.11.0
github.com/hashicorp/consulleapi/v1.15.3
github.com/hashicorp/consullev1.14.0-beta1
github.com/hashicorp/consulleproto-public/v0.1.1
consul:3.17eq1.13.3-r0
consul:3.17eq1.13.3-r1

Name	Operator	Version
github.com/hashicorp/consul	eq	sdk/v0.11.0
github.com/hashicorp/consul	le	api/v1.15.3
github.com/hashicorp/consul	le	v1.14.0-beta1
github.com/hashicorp/consul	le	proto-public/v0.1.1
github.com/hashicorp/consul	eq	sdk/v0.11.0
github.com/hashicorp/consul	le	api/v1.15.3
github.com/hashicorp/consul	le	v1.14.0-beta1
github.com/hashicorp/consul	le	proto-public/v0.1.1
consul:3.17	eq	1.13.3-r0
consul:3.17	eq	1.13.3-r1