CVE-2022-29153 — Vulnetix

CVE-2022-29153 PUBLISHED

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

EPSS 87.76% · 99.5th percentile

Risk Scores

EPSS Score

87.76%

99.5th percentile

Affected Products

Vendor	Product	Versions
Bitnami	consul	1.11.0, 0, 1.10.0
Bitnami	consul	0, 1.10.0, 1.11.0

Exploit Intelligence

CIRCL exploited: CVE-2022-29153 (circl-sighting)
CIRCL seen: CVE-2022-29153 (circl-sighting)
CIRCL seen: CVE-2022-29153 (circl-sighting)
CIRCL exploited: CVE-2022-29153 (circl-sighting)
CIRCL seen: CVE-2022-29153 (circl-sighting)
https://discuss.hashicorp.com (circl)
https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393 (circl)
https://security.netapp.com/advisory/ntap-20220602-0005/ (circl)
GLSA-202208-09 (circl)
https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/ (circl)

…and 38 more exploits

Timeline

Apr 19, 2022 CVE Published
Apr 19, 2022 PoC Published
Apr 20, 2022 EPSS Score
Apr 26, 2023 EPSS Score
Sep 17, 2023 EPSS Score
Jan 7, 2024 EPSS Score
Aug 3, 2024 CVE Updated
Oct 15, 2024 EPSS Score
Nov 11, 2024 EPSS Score
Dec 17, 2024 EPSS Score
Jan 26, 2025 PoC Published
Feb 10, 2025 PoC Published

References

Open in Interactive Console →