Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Consul: Unrestricted Access to Sensitive Resources via URL Path Bypass

CVE-2024-10005 · published 2 years ago
Summary

A vulnerability in Consul's URL filtering allows attackers to bypass intended access restrictions, potentially exposing sensitive resources. This issue affects users who rely on Consul for access control and security. Update Consul to the latest version to mitigate this risk.

What to do
  • Update github.com hashicorp to version 1.20.1.
  • Update consul to version 1.20.1.
Affected software
Ecosystem VendorProductAffected versions
go github.com hashicorp >= 1.9.0, < 1.20.1
Fix: upgrade to 1.20.1
– hashicorp consul >= 1.4.1, < 1.20.1
>= 1.9.0, < 1.15.15
>= 1.18.0, < 1.18.5
>= 1.19.0, < 1.19.3
1.20.0
cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*
Bitnami – consul >= 1.9.0, < 1.20.1
Fix: upgrade to 1.20.1
Original advisory text
Consul L7 Intentions Vulnerable To URL Path Bypass
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published30 Oct 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-chgm-7r52-whjj · GHSA
CVE-2024-10005 · NVD
BIT-consul-2024-10005 · OSV
CVE-2024-10005 · OSV
Track software like this
Free during beta