Description
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.
Problem types
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Product status
1.9.0 (semver) before 1.20.1
1.9.0 (semver) before 1.20.1
References
security.netapp.com/advisory/ntap-20250110-0004/
discuss.hashicorp.com/...tions-vulnerable-to-url-path-bypass
