PT-2021-11191 · Hashicorp+2 · Hashicorp Consul Enterprise+3

Published 2021-04-20 · Updated 2024-08-20 · CVE-2020-25864

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions prior to 1.9.5 HashiCorp Consul and Consul Enterprise versions prior to 1.8.10 HashiCorp Consul and Consul Enterprise versions prior to 1.7.14

Description: The issue concerns a cross-site scripting vulnerability in the key-value (KV) raw mode of HashiCorp Consul and Consul Enterprise.

Recommendations: For versions prior to 1.9.5, update to version 1.9.5 or later. For versions prior to 1.8.10, update to version 1.8.10 or later. For versions prior to 1.7.14, update to version 1.7.14 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-3445

ALT-PU-2023-7106

ALT-PU-2024-8028

BIT-CONSUL-2020-25864

CVE-2020-25864

GHSA-8XMX-H8RQ-H94J

GO-2023-1851

Affected Products

Alt Linux

Astra Linux

Hashicorp Consul Enterprise

Hashicorp Consul

References · 17

• https://osv.dev/vulnerability/BIT-consul-2020-25864 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1851 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25864 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8xmx-h8rq-h94j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25864 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25864 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25864 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25864 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-25864 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25864 · Security Note
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul/pull/10023 · Note