« Volver al listado

CVE-2020-12797

Estado: ModificadaMedia (5.3)—

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hashicorp — Consul

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-12797",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-11T20:15:11.210",
  "references": [
    {
      "url": "https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hashicorp/consul/pull/8047",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/hashicorp/consul/pull/8047",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4."
    },
    {
      "lang": "es",
      "value": "HashiCorp Consul y Consul Enterprise, presentaron un fallo al aplicar cambios a las reglas de token de las ACL heredadas debido a la no propagación a centros de datos secundarios. Introducido en la versión 1.4.0, corregido en las versiones 1.6.6 y 1.7.4"
    }
  ],
  "lastModified": "2026-06-17T02:52:19.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B3E87E3-68E1-484A-8E77-62EF62B2C195",
              "versionEndExcluding": "1.6.6",
              "versionStartIncluding": "1.4.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0447C968-B944-43C4-92FA-05DC8BB6F580",
              "versionEndIncluding": "1.6.6",
              "versionStartIncluding": "1.4.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C75147A9-FD13-4698-A736-1A351A96B221",
              "versionEndExcluding": "1.7.4",
              "versionStartIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804310A0-646B-4375-A7D7-002F65C3C4BC",
              "versionEndExcluding": "1.7.4",
              "versionStartIncluding": "1.7.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}