ConsulGHSA-8xmx-h8rq-h94j
HashiCorp Consul Cross-site Scripting vulnerability
Medium6.1CVE-2020-25864 · Published May 24, 2022 · updated Sep 10, 2026
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.9.0, < 1.9.5 | 1.9.5 |
| >= 1.8.0, < 1.8.10 | 1.8.10 | |
| < 1.7.14 | 1.7.14 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-consul-2020-25864, CVE-2020-25864, GO-2023-1851
More Consul advisories
All Consul| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 142022 | HashiCorp Consul can use cleartext agent-to-agent RPC communication Medium5.9May 14, 2022 | Medium5.9 | 1.4.1 |
| May 132022 | HashiCorp Consul vulnerable to Origin Validation ErrorHigh7.4May 13, 2022 | High7.4 | 1.4.4 |
| May 132022 | HashiCorp Consul Access Restriction BypassHigh8.1May 13, 2022 | High8.1 | 1.4.3 |
| Apr 202022 | Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorHigh7.5Apr 20, 2022 | High7.5 | 1.9.17+2 more |
| Feb 252022 | HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersMedium6.5Feb 25, 2022 | Medium6.5 | 1.9.15+2 more |
| Feb 152022 | Denial of Service (DoS) in HashiCorp ConsulMedium5.3Feb 15, 2022 | Medium5.3 | 1.6.6+1 more |