CVE-2023-2816

HIGH8.7EPSS 0.17%

Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner

發布日:2023/6/3修改日:2025/5/20

也稱為:GHSA-rqjq-ww83-wv5cBIT-consul-2023-2816GO-2023-1828

描述

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

受影響套件(3)

Bitnami/consul>= 1.15.0, < 1.15.3
Go/github.com/hashicorp/consul>= 1.15.0, < 1.15.3
Go/github.com/hashicorp/consul>= 1.15.0, < 1.15.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

參考連結(4)

ADVISORYhttps://github.com/advisories/GHSA-rqjq-ww83-wv5c
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-2816
PATCHhttps://github.com/hashicorp/consul
WEBhttps://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525