title: Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
description: Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
problem types: Improper Access Control
affected:
{
vendor: HashiCorp
product: Consul
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
repo: https://github.com/hashicorp/consul
versions:
status: affected, version: 1.15.0
status: affected, version: 1.15.1
status: affected, version: 1.15.2
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Consul Enterprise
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
versions:
status: affected, version: 1.15.0
status: affected, version: 1.15.1
status: affected, version: 1.15.2
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
]