CVE-2024-10086: Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation
A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10086?
CVE-2024-10086 has been classified with a medium severity due to the potential for reflected XSS attacks.
How do I fix CVE-2024-10086?
To fix CVE-2024-10086, update your Consul or Consul Enterprise installation to version 1.20.0 or later.
Which versions of Consul are affected by CVE-2024-10086?
CVE-2024-10086 affects Consul versions between 1.4.1 and 1.20.0, along with specific affected versions of Consul Enterprise and Community.
What type of attack is possible with CVE-2024-10086?
CVE-2024-10086 allows for reflected cross-site scripting (XSS) attacks due to improper handling of Content-Type HTTP headers.
Is there a workaround for CVE-2024-10086 until I can update?
Currently, the best course of action is to apply available updates, as no specific workarounds are suggested for CVE-2024-10086.