Published: 12/12/2021 Updated: 31/03/2022

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 580

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

HashiCorp Consul Enterprise prior to 1.8.17, 1.9.x prior to 1.9.11, and 1.10.x prior to 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.

Vulnerable Product	Search on Vulmon	Subscribe to Product
hashicorp consul

A vulnerability was identified in Consul Enterprise before version 1104 such that an ACL token with the default operator:write permissions in one namespace may be used to escalate privileges into any other permissions across all namespaces ...

HashiCorp Consul exploit with python. (CVE-2021-41805)

CVE-2021-41805 Hashicorp Consul RCE via API HashiCorp Consul Enterprise before 1817, 19x before 1911, and 110x before 1104 has Incorrect Access Control An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace Summary CVE_ID : CVE-2021-41805 Base Score :

HashiCorp Consul exploit with python. (CVE-2021-41805)

CVE-2021-41805 Hashicorp Consul RCE via API HashiCorp Consul Enterprise before 1817, 19x before 1911, and 110x before 1104 has Incorrect Access Control An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace Summary CVE_ID : CVE-2021-41805 Base Score :

CWE-863 https://www.hashicorp.com/blog/category/consul https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871 https://security.netapp.com/advisory/ntap-20211229-0007/https://nvd.nist.gov https://github.com/nelsondurairaj/CVE-2021-41805 https://security.archlinux.org/CVE-2021-41805

CVE-2021-41805

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect