CVE-2020-25864 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Yes
Type	Cross-site scripting
Description	A vulnerability was identified in Consul and Consul Enterprise ("Consul") up to version 1.9.4 where a specially crafted KV entry could be used to perform a cross-site scripting (XSS) attack when viewed in the raw mode. The issue is fixed in versions 1.9.5, 1.8.10 and 1.7.14.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-1829	consul	1.9.4-1	1.9.5-1	Medium	Fixed

References
https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 https://github.com/hashicorp/consul/pull/10023 https://github.com/hashicorp/consul/commit/dc937c953279bd40645d8ad020f41c6bf93df459

References

https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368
https://github.com/hashicorp/consul/pull/10023
https://github.com/hashicorp/consul/commit/dc937c953279bd40645d8ad020f41c6bf93df459