CVE-2023-2816CWE-266

Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner

High · published June 2, 2023

CVSS v3.1
8.7
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00585 · 47.2th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2023-06-02T22:43Z
EPSS history
Timeline
  • 02 JUN 22:43Z
    Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
    cvelistv5