CVE-2022-3920

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
HashiCorp	Consul	1.13.0; 1.13.1; 1.13.2; 1.13.3
HashiCorp	Consul Enterprise	1.13.0; 1.13.1; 1.13.2; 1.13.3

References

Timeline

Published: Nov 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392005.3Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events CVE-2022-392017.5Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and CVE-2022-392026.3matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple CVE-2022-392038.8matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would co CVE-2022-392059.8Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take CVE-2022-392069.9Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/CVE-2022-392075.4Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for late CVE-2022-392087.5Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be CVE-2022-392096.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polyno CVE-2022-39219.8The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, whic CVE-2022-392105.5Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files a CVE-2022-392115.3Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found