CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2023-2816
Medium (6.5) in hashicorp consul. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/consul 1.15.3.
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWE
- CWE-266
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:consul
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rqjq-ww83-wv5c | Go | github.com/hashicorp/consul | >=1.15.0 <1.15.3 | 1.15.3 |
| GO-2023-1828 | Go | github.com/hashicorp/consul | >=1.15.0 <1.15.3 | 1.15.3 |