{"id":"BIT-consul-2024-10005","revision":null,"records":[{"revision":"d2ff3051950b4273b32b8a77e1a788a9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-10005","aliases":[],"title":"Consul L7 Intentions Vulnerable To URL Path Bypass","description":"A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.","state":0,"publishedAt":"2024-10-30T21:19:22.576+00:00","modifiedAt":"2025-01-10T13:06:39.935+00:00","affected":[{"ecosystem":"Vendor product","name":"Consul","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"platforms\": [\n                        \"64 bit\",\n                        \"32 bit\",\n                        \"x86\",\n                        \"ARM\",\n                        \"MacOS\",\n                        \"Windows\",\n                        \"Linux\"\n                    ],\n                    \"product\": \"Consul\",\n                    \"repo\": \"https://github.com/hashicorp/consul\",\n                    \"vendor\": \"HashiCorp\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.20.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.9.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Consul Enterprise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"platforms\": [\n                        \"64 bit\",\n                        \"32 bit\",\n                        \"x86\",\n                        \"ARM\",\n                        \"MacOS\",\n                        \"Windows\",\n                        \"Linux\"\n                    ],\n                    \"product\": \"Consul Enterprise\",\n                    \"repo\": \"https://github.com/hashicorp/consul\",\n                    \"vendor\": \"HashiCorp\",\n                    \"versions\": [\n                        {\n                            \"changes\": [\n                                {\n                                    \"at\": \"1.19.3\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"1.18.5\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"1.15.15\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"lessThan\": \"1.20.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.9.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-10005","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-10005","identifiers":["CVE-2024-10005"]},"retained":false,"historicalAffected":[]},{"revision":"1d8740c8c92f455a982c1244089dc1b6","observedAt":"2026-11-15T00:38:02.994+00:00","statement":{"source":"euvd","id":"EUVD-2024-3020","aliases":["CVE-2024-10005","GHSA-chgm-7r52-whjj"],"title":"A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.","description":"A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1,"severity":null}],"references":["https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3020","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 30, 2024, 9:19:22 PM","dateUpdated":"Jan 10, 2025, 1:06:39 PM"},"relatedAdvisories":[{"id":"RHSA-2025:15847","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.23.0 Release.","vulnerabilityIds":["CVE-2024-10005","CVE-2024-10006","CVE-2024-22189","CVE-2024-24789","CVE-2024-28869","CVE-2024-39321","CVE-2024-45338","CVE-2025-9287","CVE-2025-9288","CVE-2025-48385","CVE-2025-48387","CVE-2025-52999"]},{"id":"SUSE-SU-2024:3950-1","title":"Security update for govulncheck-vulndb","vulnerabilityIds":["CVE-2024-0132","CVE-2024-0133","CVE-2024-10005","CVE-2024-10006","CVE-2024-10086","CVE-2024-10452","CVE-2024-39720","CVE-2024-46872","CVE-2024-47401","CVE-2024-50052","CVE-2024-50354","CVE-2024-8185"]},{"id":"openSUSE-SU-2024:0350-1","title":"Security update for govulncheck-vulndb","vulnerabilityIds":["CVE-2022-45157","CVE-2023-22644","CVE-2023-32197","CVE-2024-0132","CVE-2024-0133","CVE-2024-10005","CVE-2024-10006","CVE-2024-10086","CVE-2024-10214","CVE-2024-10241","CVE-2024-10452","CVE-2024-22030","CVE-2024-22036","CVE-2024-33662","CVE-2024-36814","CVE-2024-38365","CVE-2024-39223","CVE-2024-39720","CVE-2024-46872","CVE-2024-47003","CVE-2024-47067","CVE-2024-47182","CVE-2024-47401","CVE-2024-47534","CVE-2024-47616","CVE-2024-47825","CVE-2024-47827","CVE-2024-47832","CVE-2024-47877","CVE-2024-48909","CVE-2024-48921","CVE-2024-49380","CVE-2024-49381","CVE-2024-49753","CVE-2024-49757","CVE-2024-50052","CVE-2024-50312","CVE-2024-50354","CVE-2024-7558","CVE-2024-7594","CVE-2024-8037","CVE-2024-8038","CVE-2024-8185","CVE-2024-8901","CVE-2024-8975","CVE-2024-8996","CVE-2024-9180","CVE-2024-9264","CVE-2024-9312","CVE-2024-9313","CVE-2024-9341","CVE-2024-9355","CVE-2024-9407","CVE-2024-9486","CVE-2024-9594","CVE-2024-9675"]},{"id":"openSUSE-SU-2024:14458-1","title":"govulncheck-vulndb-0.0.20241104T154416-1.1 on GA media","vulnerabilityIds":["CVE-2024-0132","CVE-2024-0133","CVE-2024-10005","CVE-2024-10006","CVE-2024-10086","CVE-2024-10452","CVE-2024-46872","CVE-2024-47401","CVE-2024-50052"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-3020","identifiers":["EUVD-2024-3020","CVE-2024-10005","GHSA-chgm-7r52-whjj"]},"retained":false,"historicalAffected":[]},{"revision":"027d936efbeb49e68a63faa886345a03","observedAt":"2026-10-24T23:17:16.684+00:00","statement":{"source":"nvd","id":"CVE-2024-10005","aliases":[],"title":"A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.","description":"A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.","state":0,"publishedAt":"2024-10-30T22:15:02.82+00:00","modifiedAt":"2026-06-17T06:54:44.94+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security@hashicorp.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass","https://security.netapp.com/advisory/ntap-20250110-0004/"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-10005","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-22"],"productCriteria":["cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*","cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*","cpe:2.3:a:hashicorp:consul:1.20.0:*:*:*:enterprise:*:*:*"],"sourceDates":{"published":"2024-10-30T22:15:02.820","lastModified":"2026-06-17T06:54:44.940"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-10005","identifiers":["CVE-2024-10005"]},"retained":false,"historicalAffected":[]},{"revision":"260cef45fc4f4229b3a875310fb179fe","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-chgm-7r52-whjj","aliases":["BIT-consul-2024-10005","CVE-2024-10005","GO-2024-3243"],"title":"Hashicorp Consul Path Traversal vulnerability","description":"A vulnerability was identified in Consul and Consul Enterprise (\"Consul\") such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.","state":0,"publishedAt":"2024-10-31T00:30:36+00:00","modifiedAt":"2026-09-10T03:50:55.9467591+00:00","affected":[{"ecosystem":"Go","name":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.9.0"},{"kind":"fixed","version":"1.20.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-10005","https://github.com/hashicorp/consul/pull/21816","https://github.com/hashicorp/consul/commit/d9206fc7e284a9244af4d62f8653a63ca30bd00c","https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass","https://github.com/advisories/GHSA-chgm-7r52-whjj","https://github.com/hashicorp/consul","https://security.netapp.com/advisory/ntap-20250110-0004"],"sourceUrl":"https://github.com/advisories/GHSA-chgm-7r52-whjj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-chgm-7r52-whjj","identifiers":["GHSA-chgm-7r52-whjj","BIT-consul-2024-10005","CVE-2024-10005","GO-2024-3243"]},"retained":false,"historicalAffected":[]},{"revision":"6421650dd426470e82e0f66164195286","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2024-3243","aliases":["BIT-consul-2024-10005","CVE-2024-10005","GHSA-chgm-7r52-whjj"],"title":"Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul","description":"Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul","state":0,"publishedAt":"2024-11-04T15:44:16+00:00","modifiedAt":"2026-02-04T03:00:13.789758+00:00","affected":[{"ecosystem":"Go","name":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.9.0"},{"kind":"fixed","version":"1.20.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-chgm-7r52-whjj","https://nvd.nist.gov/vuln/detail/CVE-2024-10005","https://github.com/hashicorp/consul/commit/d9206fc7e284a9244af4d62f8653a63ca30bd00c","https://github.com/hashicorp/consul/pull/21816","https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"],"sourceUrl":"https://osv.dev/vulnerability/GO-2024-3243","license":"OSV · upstream source license applies","key":"osv:GO-2024-3243","identifiers":["GO-2024-3243","BIT-consul-2024-10005","CVE-2024-10005","GHSA-chgm-7r52-whjj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T20:44:14.5536813+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T20:44:14.5536813+00:00","lastSuccessAt":"2026-11-15T20:44:14.7860515+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:14.7860528+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-f8a60997f6dce668b540a4f14f94592eb9e1c16849f01d8d6e2c78b68e21421f","complete":true,"records":425849,"lastAttemptAt":"2026-11-15T20:44:12.7538826+00:00","lastSuccessAt":"2026-11-15T20:44:12.7235178+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:12.7538826+00:00","snapshotPublishedAt":"2026-11-15T20:32:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d1da285a9bc641e2becc5e6c7fa6e0bc","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T20:55:04.9136593+00:00","lastSuccessAt":"2026-11-15T20:55:04.909+00:00","error":"81 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T20:55:04.909+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13793,"expectedIdentifiers":13874,"failedIdentifiers":81},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T20:44:14.5536813+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T20:44:14.5536813+00:00","lastSuccessAt":"2026-11-15T20:44:14.7868578+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:14.7868581+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-83941b66a7344db698aff661acaa6ebf","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T20:44:58.4504738+00:00","lastSuccessAt":"2026-11-15T20:44:58.441+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:58.441+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T20:44:14.4134166+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:14.4134166+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T20:44:13.8592897+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:13.8592897+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T20:44:14.44199+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:14.44199+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T20:44:14.2324599+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T20:44:14.2324599+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}