Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2024-10086

Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 1.4.1 to < 1.20.0affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 1.4.1 to < 1.20.0affected

References