CVE-2020-7955: Medium severity Hashicorp Consul vulnerability
Published Jan 31, 2020
·Updated
HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.
Affected Software
2 affected components
Hashicorp Consul>=1.4.1<1.6.2
Hashicorp Consul>=1.4.1<1.6.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Consul and Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.6.3
Event History
Jan 31, 2020
CVE Published
via MITRE·12:19 PM
Data Sourced
via MITRE·12:19 PM
Description
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-7955.
2
What is the severity rating for CVE-2020-7955?
The severity rating is 5.3, which is considered medium.
3
What is the affected software for CVE-2020-7955?
The affected software is HashiCorp Consul and Consul Enterprise versions 1.4.1 through 1.6.2.
4
What is the impact of CVE-2020-7955?
The vulnerability could result in potential unintended information disclosure.
5
How can I fix CVE-2020-7955?
The vulnerability is fixed in version 1.6.3 of HashiCorp Consul and Consul Enterprise.