Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2023-2816

Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 1.15.0affected
  • 1.15.1affected
  • 1.15.2affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 1.15.0affected
  • 1.15.1affected
  • 1.15.2affected

References