Infrastructure and Network

In Consul versions 1.9.0 and earlier than 1.20.1 a high severity vulnerability CVE-2024-10005 was detected. This vulnerability allows attackers to bypass HTTP request path-based access rules by using URL paths in L7 traffic intentions. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-10005.

In Consul versions 1.4.1 through 1.19.x a medium severity vulnerability CVE-2024-10086 was found. This issue could let attackers misuse user input, potentially causing a reflected XSS attack because the server response doesn’t include a Content-Type HTTP header. Currently, there is no fix for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-10086.

In Consul versions 1.9.0 through 1.20.0 a high severity vulnerability CVE-2024-10006 was detected. This vulnerability allows attackers to bypass HTTP header-based access rules by exploiting Headers in L7 traffic intentions. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-10006.

In Vault Community versions from 1.2.0 up to 1.18.0 and Vault Enterprise versions from 1.2.0 up to 1.18.0, 1.17.7, 1.16.11 a medium severity vulnerability CVE-2024-8185 was detected. This vulnerability allows attackers to crash Vault clusters by sending too many requests to a specific API endpoint, which can use up all the available memory and disrupt the service. To fix this issue, users should update Vault Community to version 1.18.1 and Vault Enterprise to versions 1.18.1, 1.17.8, and 1.16.12. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8185.

In Keycloak version before 24.0.5 a high severity vulnerability CVE-2024-3656 was detected. This vulnerability allows low-privilege users to access administrative functionalities via certain endpoints in the admin REST API, potentially leading to data breaches or system compromise. To fix this issue, users must upgrade to 24.0.5 version or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-3656.

In Vault Community Edition versions from 1.7.7 up to 1.17.5 and Vault Enterprise from 1.7.7 up to 1.17.5, 1.16.9, and 1.15.14 a medium severity vulnerability CVE-2024-7594 was detected. This vulnerability allows attackers to authenticate as any user on the host by exploiting an SSH certificate requested by an authorized user, potentially leading to unauthorized access to sensitive resources and data. To fix this issue, users should upgrade Vault Community Edition to version 1.17.6 and Vault Enterprise to versions 1.17.6, 1.16.10, and 1.15.15 For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-7594.

In Authentik versions prior to 2024.8.3 and 2024.6.5 a medium severity vulnerability CVE-2024-47070 was detected. This vulnerability allows attackers to bypass the password login and access any account if they can provide an invalid IP address in the X-Forwarded-For header, but only if the system trusts that header. To fix this issue, users should upgrade Authentik to versions 2024.8.3 or 2024.6.5. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-47070.

In Authentik versions prior to 2024.8.3 and 2024.6.5 a medium severity vulnerability CVE-2024-47077 was detected. This vulnerability allows attackers to steal access tokens from one application and use them to access or impersonate users in other applications without authorization. To fix this issue, users should upgrade Authentik to versions 2024.8.3 or 2024.6.5. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-47077.

In Keycloak versions before version 24.0.8 a medium severity vulnerability CVE-2024-8883 was detected. This vulnerability allows attackers to redirect users to fake websites, potentially stealing sensitive information like login details and taking over user accounts. To fix this issue, users should upgrade Keycloak to version 25.0.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8883.