What is GHSA-gw2g-hhc9-wgjh?

GHSA-gw2g-hhc9-wgjh is a security advisory published by GitHub Security Advisories with High severity. Missing Authorization in HashiCorp Consul

Which CVE IDs does GHSA-gw2g-hhc9-wgjh cover?

GHSA-gw2g-hhc9-wgjh covers the following CVE IDs: CVE-2022-3920. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gw2g-hhc9-wgjh?

GHSA-gw2g-hhc9-wgjh has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-gw2g-hhc9-wgjh?

GHSA-gw2g-hhc9-wgjh affects 1 product, including: go/github.com/hashicorp/consul:\u003e= 1.13.0, \u003c 1.14.0.

GHSA-gw2g-hhc9-wgjhHighCVSS 7.5

Missing Authorization in HashiCorp Consul

Vendor

GitHub Security Advisories

Published

November 16, 2022

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2022-3920 →

📋 Description

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

🎯 Affected products1

go/github.com/hashicorp/consul:>= 1.13.0, < 1.14.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-3920
https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946
https://github.com/hashicorp/consul/commit/706866fa0016b0aa302679f9c648859050d19b2e
https://github.com/advisories/GHSA-gw2g-hhc9-wgjh