← CVE Intelligence

CVE-2023-2816

Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner PUBLISHED

Description (CNA)

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

Affected (CNA)

Vendor / productVersions
HashiCorp / Consulaffected 1.15.0; affected 1.15.1; affected 1.15.2
HashiCorp / Consul Enterpriseaffected 1.15.0; affected 1.15.1; affected 1.15.2

CWE

CWE-266

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.