{
  "threat_severity" : "Important",
  "public_date" : "2024-10-30T21:20:37Z",
  "bugzilla" : {
    "description" : "hashicorp/consul: consul: Consul L7 Intentions Vulnerable To Headers Bypass",
    "id" : "2322858",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2322858"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-644",
  "details" : [ "A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.", "A flaw was found in HashiCorp Consul and Consul Enterprise. The server response does not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and can lead to reflected cross-site scripting (XSS)." ],
  "statement" : "This vulnerability is rated as important severity because HashiCorp Consul fails to set a Content-Type HTTP header, allowing user inputs to be misinterpreted and potentially leading to reflected cross-site scripting (XSS). This can compromise both confidentiality and integrity, posing a risk to user data and application security, which requires prompt remediation.",
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Dev Spaces (RHOSDS) 3.23",
    "release_date" : "2025-09-15T00:00:00Z",
    "advisory" : "RHSA-2025:15847",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3.23::el9",
    "package" : "devspaces/traefik-rhel9:sha256:15a4a74016cdb94aece0bc651edd221b72a9202e5fd414d30ae969707cb5b4c9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-10006\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-10006\nhttps://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass" ],
  "name" : "CVE-2024-10006",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}