6.5

CVE-2022-40716

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Data is provided by the National Vulnerability Database (NVD)
Hashicorp ≫ Consul SwEdition- Version < 1.11.9
Hashicorp ≫ Consul SwEditionenterprise Version < 1.11.9
Hashicorp ≫ Consul SwEdition- Version >= 1.12.0 < 1.12.5
Hashicorp ≫ Consul SwEditionenterprise Version >= 1.12.0 < 1.12.5
Hashicorp ≫ Consul SwEdition- Version >= 1.13.0 < 1.13.2
Hashicorp ≫ Consul SwEditionenterprise Version >= 1.13.0 < 1.13.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.26% 0.491
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-252 Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.