Riskcovery

CVE-2024-10086

Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

State
Published
Severity
6.1 Medium
Published
Oct 30, 2024
Updated
Jan 10, 2025
Reserved
Oct 17, 2024

Read the record on cve.org

Description

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NHashiCorp

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation

Affected Products

ProductVersions
ConsulHashiCorp
  • 1.4.1 to before 1.20.0Affected
Consul EnterpriseHashiCorp
  • 1.4.1 to before 1.20.0Affectedfrom 1.19.3Not affectedfrom 1.18.5Not affectedfrom 1.15.15Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.