title: Consul Peering Imported Nodes/Services Leak
description: HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: HashiCorp
product: Consul
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
repo: https://github.com/hashicorp/consul
versions:
status: affected, version: 1.13.0
status: affected, version: 1.13.1
status: affected, version: 1.13.2
status: affected, version: 1.13.3
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Consul Enterprise
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
versions:
status: affected, version: 1.13.0
status: affected, version: 1.13.1
status: affected, version: 1.13.2
status: affected, version: 1.13.3
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
]