AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-8xmx-h8rq-h94j

HashiCorp Consul Cross-site Scripting vulnerability

Consul

CVE-2020-25864 · Published May 24, 2022 · updated Sep 10, 2026

Medium6.1
Fix: upgrade to 1.7.14 or later (3 fixed versions below)
GitHub advisory

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.9.0, < 1.9.51.9.5
>= 1.8.0, < 1.8.101.8.10
< 1.7.141.7.14
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
BIT-consul-2020-25864, CVE-2020-25864, GO-2023-1851

More Consul advisories

All Consul
Medium 5.9May 14, 2022HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1High 7.4May 13, 2022HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4High 8.1May 13, 2022HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3High 7.5Apr 20, 2022Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorCVE-2022-29153fixed in 1.9.17 +2Medium 6.5Feb 25, 2022HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersCVE-2022-24687fixed in 1.9.15 +2Medium 5.3Feb 15, 2022Denial of Service (DoS) in HashiCorp ConsulCVE-2020-12758fixed in 1.6.6 +1