CVE Vulnerabilities

CVE-2022-29153

Server-Side Request Forgery (SSRF)

Published: Apr 19, 2022 | Modified: Oct 19, 2022
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
7.5 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Ubuntu

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

Weakness

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Software

Name Vendor Start Version End Version
Consul Hashicorp 1.11.0 *
Consul Hashicorp 1.11.0 *
Consul Hashicorp 1.10.0 *
Consul Hashicorp 1.10.0 *
Consul Hashicorp * *
Consul Hashicorp * *
Consul Ubuntu impish *
Consul Ubuntu trusty *
Consul Ubuntu xenial *

References