GHSA-99wr-c2px-grmh

Hashicorp Consul Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-10086

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/consul	>= 1.4.1, < 1.20.0	1.20.0

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-10086 advisory
https://github.com/hashicorp/consul/commit/07fae7bb0be8593cc98c38b1ef4a49ed9188932f web
https://discuss.hashicorp.com/t/hcsec-2024-24-consul-vulnerable-to-reflected-xss-on-content-type-error-manipulation web
https://github.com/advisories/GHSA-99wr-c2px-grmh advisory
https://github.com/hashicorp/consul package
https://security.netapp.com/advisory/ntap-20250110-0006 web