← Back

CVE-2020-28053

nvd nist
Published: Nov 23, 2020Modified: Nov 21, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.

Affected (6)

Products: Hashicorp: Consul
Hashicorp
1 product
Consul
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Consul
From 1.2.0 to 1.6.10
Consul
From 1.7.0 to 1.7.10
Consul
From 1.8.0 to 1.8.6
Consul
From 1.2.0 to 1.6.10
Consul
From 1.7.0 to 1.7.10
Consul
From 1.8.0 to 1.8.6

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

Source: cve@mitre.org
Release NotesThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ProductVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ProductVendor Advisory

Timeline

No history available yet.