CVE-2024-10086

Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

Summary

Original description

The description as published by the source.

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami consul

[{"type":"SEMVER","events":[{"introduced":"1.4.1"},{"fixed":"1.20.0"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-10086 consul

References

advisory discuss.hashicorp.com
web security.netapp.com
web nvd.nist.gov