CVSS 3.0
8.1 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-8336
High (8.1) in hashicorp consul. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/consul 1.4.3.
HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:consul
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fhm8-cxcv-pwvc | Go | github.com/hashicorp/consul | >=1.4.0 <1.4.3 | 1.4.3 |
| GO-2023-1945 | Go | github.com/hashicorp/consul | >=1.4.0 <1.4.3 | 1.4.3 |