CVE-2023-2816

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-281606.5When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking po CVE-2023-281618.8If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permis CVE-2023-281628.8While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially CVE-2023-281636.5When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would h CVE-2023-281646.5Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. Th CVE-2023-281654.3Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Cont CVE-2023-281666.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions.CVE-2023-281678.8Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions.CVE-2023-281683.7Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels CVE-2023-281694.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <= 1.0 versions.CVE-2023-28175.4A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be i CVE-2023-281707.2Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a th