CVE-2024-10006

Consul L7 Intentions Vulnerable To Headers Bypass

State: Published
Severity: 8.3 High
Published: Oct 30, 2024
Updated: Jan 10, 2025
Reserved: Oct 15, 2024

Description

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L	HashiCorp

Weaknesses

CWE-644 Improper Neutralization of HTTP Headers

Affected Products

Product	Versions
ConsulHashiCorp	1.9.0 to before 1.20.1Affected
Consul EnterpriseHashiCorp	1.9.0 to before 1.20.1Affectedfrom 1.19.3Not affectedfrom 1.18.5Not affectedfrom 1.15.15Not affected

References

https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass
https://security.netapp.com/advisory/ntap-20250110-0005/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.