CVE-2024-10086

Description

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.

PUBLISHED Reserved 2024-10-17 | Published 2024-10-30 | Updated 2025-01-10 | Assigner HashiCorp

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation

Product status

References

discuss.hashicorp.com/...-on-content-type-error-manipulation

cve.org (CVE-2024-10086)

nvd.nist.gov (CVE-2024-10086)

Download JSON