PT-2021-23416 · Hashicorp+1 · Hashicorp Consul Enterprise+1

Published 2021-12-02 · Updated 2024-05-22 · CVE-2021-41805

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul Enterprise versions prior to 1.8.17 HashiCorp Consul Enterprise versions 1.9.x prior to 1.9.11 HashiCorp Consul Enterprise versions 1.10.x prior to 1.10.4

Description The issue concerns Incorrect Access Control, where an ACL token with default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace.

Recommendations For versions prior to 1.8.17, update to version 1.8.17 or later. For versions 1.9.x prior to 1.9.11, update to version 1.9.11 or later. For versions 1.10.x prior to 1.10.4, update to version 1.10.4 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2021-3445

ALT-PU-2023-7106

ALT-PU-2024-8028

BIT-CONSUL-2021-41805

CVE-2021-41805

Affected Products

Alt Linux

Hashicorp Consul Enterprise

References · 10

• https://osv.dev/vulnerability/BIT-consul-2021-41805 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41805 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41805 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41805 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41805 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41805 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20211229-0007 · Note
• https://t.me/cvenotify/24556 · Telegram Post