« Volver al listado

CVE-2023-1297

Estado: ModificadaAlta (7.5)—

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hashicorp — Consul

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-1297",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-1297",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-08T17:50:24.766676Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@hashicorp.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@hashicorp.com",
      "affectedData": [
        {
          "repo": "https://github.com/hashicorp/consul",
          "vendor": "HashiCorp",
          "product": "Consul",
          "versions": [
            {
              "status": "affected",
              "version": "1.14.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.14.5"
            },
            {
              "status": "affected",
              "version": "1.15.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.15.3"
            }
          ],
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "HashiCorp",
          "product": "Consul Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "1.14.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.14.5"
            },
            {
              "status": "affected",
              "version": "1.15.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.15.3"
            }
          ],
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-06-02T23:15:09.293",
  "references": [
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@hashicorp.com"
    },
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@hashicorp.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-826"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3"
    }
  ],
  "lastModified": "2026-06-17T05:27:35.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0047DE25-5AF8-4BE3-BAE0-883C5B933D56",
              "versionEndExcluding": "1.14.7",
              "versionStartIncluding": "1.13.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A54134BC-44F1-490A-90C6-DA20ADFF2239",
              "versionEndExcluding": "1.14.7",
              "versionStartIncluding": "1.13.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D592391-F006-4F99-BF39-DAA3D2B86305",
              "versionEndExcluding": "1.15.3",
              "versionStartIncluding": "1.15.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12E16E32-03E5-44B6-BAB5-8809E6E852F4",
              "versionEndExcluding": "1.15.3",
              "versionStartIncluding": "1.15.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@hashicorp.com"
}