CVE-2021-28156
HIGHCVSS 7.5/10EPSS 2.27%
Last modified
CVE-2021-28156 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.. EPSS estimates a 2.27% chance of exploitation in the next 30 days.
Description
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Consul | >= 1.8.0, < 1.8.10 |
| Hashicorp | Consul | >= 1.9.0, < 1.9.5 |
References
- https://security.gentoo.org/glsa/202208-09Third Party Advisory
- https://www.hashicorp.com/blog/category/consulVendor Advisory
- https://security.gentoo.org/glsa/202208-09Third Party Advisory
- https://www.hashicorp.com/blog/category/consulVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-28156?
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
How severe is CVE-2021-28156?
CVE-2021-28156 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 2.27% probability of exploitation in the next 30 days.
How do I fix CVE-2021-28156?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-28150Hongdian H8922 3.0.5 devices allow the unprivileged guest us…5.5
- CVE-2021-28151Hongdian H8922 3.0.5 devices allow OS command injection via …8.8
- CVE-2021-28152Hongdian H8922 3.0.5 devices have an undocumented feature th…9.8
- CVE-2021-28153An issue was discovered in GNOME GLib before 2.66.8. When g_…5.3
- CVE-2021-28154Camunda Modeler (aka camunda-modeler) through 4.6.0 allows a…9.1
- CVE-2021-28155The Bluetooth Classic implementation on JBL TUNE500BT device…6.5
- CVE-2021-28157An SQL Injection issue in Devolutions Server before 2021.1 a…7.2
- CVE-2021-28160Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a…6.1
- CVE-2021-28161In Eclipse Theia versions up to and including 1.8.0, in the …6.1
- CVE-2021-28162In Eclipse Theia versions up to and including 0.16.0, in the…6.1
- CVE-2021-28163In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, a…2.7
- CVE-2021-28164In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the d…5.3
Are you affected by CVE-2021-28156?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST