CVE-2023-3518 — JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

CVE-2023-3518

JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access PUBLISHED

Description (CNA)

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Consul	affected 1.16.0
HashiCorp / Consul Enterprise	affected 1.16.0

CWE

CWE-266

References

https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004

ADP enrichment

CVE

No English description supplied.

https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004

CISA-ADP

No English description supplied.

No references supplied.