GHSA-8xmx-h8rq-h94j

HashiCorp Consul Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-25864

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/consul	>= 1.9.0, < 1.9.5	1.9.5
Go	github.com/hashicorp/consul	>= 1.8.0, < 1.8.10	1.8.10
Go	github.com/hashicorp/consul	< 1.7.14	1.7.14

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-25864 advisory
https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 web
https://github.com/hashicorp/consul package
https://security.gentoo.org/glsa/202208-09 web
https://www.hashicorp.com/blog/category/consul web