CVE-2020-28053

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#186-november-19-2020Release Notes, Third Party Advisory
https://security.gentoo.org/glsa/202208-09Third Party Advisory
https://www.hashicorp.com/blog/category/consulProduct, Vendor Advisory
https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#186-november-19-2020Release Notes, Third Party Advisory
https://security.gentoo.org/glsa/202208-09Third Party Advisory
https://www.hashicorp.com/blog/category/consulProduct, Vendor Advisory

Timeline

Published: Nov 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-280547.5JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly CVE-2020-280557.8A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group C CVE-2020-28065.3Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling). Supported versions that are affected are 5.7.28 an CVE-2020-280627.2An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath. '/ Up CVE-2020-280639.8A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.CVE-2020-28078.2Vulnerability in the Oracle Marketing Encyclopedia System product of Oracle E-Business Suite (component: Administration). Supported versions CVE-2020-280709.8SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_even CVE-2020-280714.8SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. After the admin authentication CVE-2020-280727.2A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary CVE-2020-280739.8SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and imperso CVE-2020-280749.8SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication sys CVE-2020-28088.2Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: DBI Setups). Supported versions that are