{
  "threat_severity" : "Low",
  "public_date" : "2024-10-30T21:19:22Z",
  "bugzilla" : {
    "description" : "hashicorp/consul: consul: Consul L7 Intentions Vulnerable To URL Path Bypass",
    "id" : "2322857",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2322857"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-22",
  "details" : [ "A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.", "A vulnerability was found in HashiCorp Consul. Due to a lack of path normalization, URL paths in L7 traffic intentions can be exploited to bypass permissions defined in the intentions." ],
  "statement" : "This vulnerability is rated as important severity because the lack of path normalization in HashiCorp Consul allows attackers to exploit URL paths in L7 traffic intentions, bypassing defined permissions. This can compromise both confidentiality and integrity, enabling unauthorized access to sensitive data and resources, highlighting the need for immediate attention.\nThis CVE has been rated \"Low\" as RH does not use Consul/Consul Catalog as a provider for configuration discovery in Traefik Proxy. Even though the product is affected, RH products are not vulnerable.",
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Dev Spaces (RHOSDS) 3.23",
    "release_date" : "2025-09-15T00:00:00Z",
    "advisory" : "RHSA-2025:15847",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3.23::el9",
    "package" : "devspaces/traefik-rhel9:sha256:15a4a74016cdb94aece0bc651edd221b72a9202e5fd414d30ae969707cb5b4c9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-10005\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-10005\nhttps://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass" ],
  "name" : "CVE-2024-10005",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}