CVE-2022-3920

Consul Peering Imported Nodes/Services Leak

State: Published
Severity: 5.3 Medium
Published: Nov 15, 2022
Updated: Apr 29, 2025
Reserved: Nov 9, 2022

Description

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	HashiCorp

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
ConsulHashiCorp	1.13.0Affected 1.13.1Affected 1.13.2Affected 1.13.3Affected
Consul EnterpriseHashiCorp	1.13.0Affected 1.13.1Affected 1.13.2Affected 1.13.3Affected

References

https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.