CVE-2022-29153
At a glance Severity Not available EPSS EPSS 8.75 % · percentile 95 (2026-10-27) State PUBLISHED Published 2022-04-19 Updated 2024-08-03 Assigner mitre NVD status Modified Description HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories GHSA-q6h7-4qgw-2j9p — Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorGO-2022-0615 — Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector in github.com/hashicorp/consulEuropean references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* < 1.9.17cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* < 1.9.17cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* ≥ 1.10.0 < 1.10.10cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* ≥ 1.10.0 < 1.10.10cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* ≥ 1.11.0 < 1.11.5cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* ≥ 1.11.0 < 1.11.5cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*Affected products Product Versions affected n/a
References
Sources
