{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10005", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2024-10-15T17:46:30.633Z", "datePublished": "2024-10-30T21:19:22.576Z", "dateUpdated": "2024-10-31T14:01:55.370Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"lessThan": "1.20.1", "status": "affected", "version": "1.9.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul Enterprise", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"changes": [{"at": "1.19.3", "status": "unaffected"}, {"at": "1.18.5", "status": "unaffected"}, {"at": "1.15.15", "status": "unaffected"}], "lessThan": "1.20.1", "status": "affected", "version": "1.9.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.</p><br/>"}], "value": "A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126: Path Traversal"}]}], "metrics": [{"cvssV3_1": {"baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-10-30T21:19:22.576Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"}], "source": {"advisory": "HCSEC-2024-22", "discovery": "EXTERNAL"}, "title": "Consul L7 Intentions Vulnerable To URL Path Bypass"}, "adp": [{"affected": [{"vendor": "hashicorp", "product": "consul", "cpes": ["cpe:2.3:a:hashicorp:consul:-:*:*:*:enterprise:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.9.0", "status": "affected", "lessThan": "1.20.1", "versionType": "semver"}, {"version": "1.19.3", "status": "unaffected"}, {"version": "1.18.5", "status": "unaffected"}, {"version": "1.15.15", "status": "unaffected"}]}, {"vendor": "hashicorp", "product": "consul", "cpes": ["cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.9.0", "status": "affected", "lessThan": "1.20.1", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-31T13:59:37.966921Z", "id": "CVE-2024-10005", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T14:01:55.370Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10005", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-31T13:59:37.966921Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hashicorp:consul:-:*:*:*:enterprise:*:*:*"], "vendor": "hashicorp", "product": "consul", "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}, {"status": "unaffected", "version": "1.19.3"}, {"status": "unaffected", "version": "1.18.5"}, {"status": "unaffected", "version": "1.15.15"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*"], "vendor": "hashicorp", "product": "consul", "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T14:01:50.337Z"}}], "cna": {"title": "Consul L7 Intentions Vulnerable To URL Path Bypass", "source": {"advisory": "HCSEC-2024-22", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126: Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "product": "Consul", "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}, {"repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "product": "Consul Enterprise", "versions": [{"status": "affected", "changes": [{"at": "1.19.3", "status": "unaffected"}, {"at": "1.18.5", "status": "unaffected"}, {"at": "1.15.15", "status": "unaffected"}], "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-10-30T21:19:22.576Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10005", "state": "PUBLISHED", "dateUpdated": "2024-10-31T14:01:55.370Z", "dateReserved": "2024-10-15T17:46:30.633Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2024-10-30T21:19:22.576Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*", "matchCriteriaId": "0D16200E-5F65-48AE-A0A5-FFADA05CA755", "versionEndExcluding": "1.20.1", "versionStartIncluding": "1.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "4F4529FE-6B11-4CB9-A8A2-A75D10470294", "versionEndExcluding": "1.15.15", "versionStartIncluding": "1.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "36CDCEB8-8B22-4290-9071-81CE3F0F6B95", "versionEndExcluding": "1.18.5", "versionStartIncluding": "1.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "0AB043DB-FC48-4DE7-80BA-EC410ECD44F2", "versionEndExcluding": "1.19.3", "versionStartIncluding": "1.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:1.20.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "82C595D9-B7F7-487B-A2B4-B85A45DF471C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en Consul y Consul Enterprise (\u201cConsul\u201d) tal que el uso de rutas URL en intenciones de tr\u00e1fico L7 podr\u00eda eludir las reglas de acceso basadas en rutas de solicitud HTTP."}], "id": "CVE-2024-10005", "lastModified": "2024-11-08T18:10:09.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security@hashicorp.com", "type": "Secondary"}]}, "published": "2024-10-30T22:15:02.820", "references": [{"source": "security@hashicorp.com", "tags": ["Vendor Advisory"], "url": "https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"}], "sourceIdentifier": "security@hashicorp.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@hashicorp.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hashicorp/consul: consul: Consul L7 Intentions Vulnerable To URL Path Bypass", "id": "2322857", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322857"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.", "A vulnerability was found in HashiCorp Consul. Due to a lack of path normalization, URL paths in L7 traffic intentions can be exploited to bypass permissions defined in the intentions."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-10005", "package_state": [{"cpe": "cpe:/a:redhat:openshift_devspaces:3::el8", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel8", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2024-10-30T21:19:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-10005\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-10005\nhttps://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"], "statement": "This vulnerability is rated as important severity because the lack of path normalization in HashiCorp Consul allows attackers to exploit URL paths in L7 traffic intentions, bypassing defined permissions. This can compromise both confidentiality and integrity, enabling unauthorized access to sensitive data and resources, highlighting the need for immediate attention.\nThis CVE has been rated \"Low\" as RH does not use Consul/Consul Catalog as a provider for configuration discovery in Traefik Proxy. Even though the product is affected, RH products are not vulnerable.", "threat_severity": "Low"}