CVE-2023-3518
Assigner: HashiCorp
Published: 2023-08-09T15:06:52.406Z
State: PUBLISHED
title: JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
problemTypes: descriptions: cweId: CWE-285
description: CWE-285 Improper Authorization
type: CWE
impacts: capecId: CAPEC-1
descriptions: value: CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
affected: vendor: HashiCorp
product: Consul
platforms: 64 bit
32 bit
x86
ARM
MacOS
Windows
Linux
repo: https://github.com/hashicorp/consul
versions: status: affected
version: 1.16.0
defaultStatus: unaffected
vendor: HashiCorp
product: Consul Enterprise
platforms: 64 bit
32 bit
x86
ARM
MacOS
Windows
Linux
versions: status: affected
version: 1.16.0
defaultStatus: unaffected
descriptions: value: HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
supportingMedia: type: text/html
base64: no
value: HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
source: discovery: INTERNAL