Fluid Attacks Database

Description

Hashicorp Consul Cross-site Scripting vulnerability A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	consul	=1.10.12+dfsg1-1 \|\| =1.8.7+dfsg1-2 \|\| =1.8.7+dfsg1-3 \|\| =1.8.7+dfsg1-4 \|\| =1.8.7+dfsg1-5 \|\| =1.8.7+dfsg1-6 \|\| =1.9.17+dfsg2-1	-
go	github.com/hashicorp/consul	>=1.4.1 <1.20.0	1.20.0

Aliases

1. CVE-2024-100862. NVD-2024-100863. OSV-DEBIAN-2024-100864. OSV-2024-100865. GHSA-99wr-c2px-grmh6. GCVE-2024-100867. SECURITY-TRACKER-CVE-2024-10086

References

1. https://github.com/hashicorp/consul/commit/07fae7bb0be8593cc98c38b1ef4a49ed9188932f2. https://discuss.hashicorp.com/t/hcsec-2024-24-consul-vulnerable-to-reflected-xss-on-content-type-error-manipulation3. https://security.netapp.com/advisory/ntap-20250110-0006

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.