PT-2023-21601 · Hashicorp+1 · Hashicorp Consul Enterprise+2

Published 2023-06-02 · Updated 2024-09-26 · CVE-2023-2816

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Consul and Consul Enterprise (affected versions not specified)

Description The issue allows any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

ALT-PU-2023-1946

AZL-27396

AZL-35303

BIT-CONSUL-2023-2816

CVE-2023-2816

GHSA-RQJQ-WW83-WV5C

GO-2023-1828

Affected Products

Alt Linux

Hashicorp Consul

Hashicorp Consul Enterprise

References · 15

• https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rqjq-ww83-wv5c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2816 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2816 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35303 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2816 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2023-2816 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27396 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-2816 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2816 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1828 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://t.me/cvenotify/51649 · Telegram Post
• https://t.me/cvenotify/96220 · Telegram Post
• https://github.com/advisories/GHSA-rqjq-ww83-wv5c · Note