{"id":"CVE-2022-3920","aliases":["ALPINE-CVE-2022-3920","BIT-consul-2022-3920","EUVD-2022-7353","GHSA-gw2g-hhc9-wgjh","GO-2022-1121","MGASA-2023-0009","UBUNTU-CVE-2022-3920"],"status":"published","title":"Consul Peering Imported Nodes/Services Leak","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00718,"percentile":0.54136,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2022-11-15T23:25:30Z","modified":"2026-11-03T07:30:39Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","fixed_in":["1.14.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.17","package":"consul","fixed_in":["1.14.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"consul","fixed_in":["1.14.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"consul","fixed_in":["1.13.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.14.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.14.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.14.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.14.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.14.0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.22-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.4~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.7~dfsg1-5ubuntu1","1.4.4~dfsg1-2ubuntu2","1.5.2+dfsg1-6","1.5.2+dfsg1-10","1.5.2+dfsg1-12","1.5.2+dfsg2-14"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4+dfsg1-1","1.8.7+dfsg1-3"]}],"products":[{"vendor":"hashicorp","product":"consul"},{"vendor":"hashicorp","product":"consul enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3920","tags":["web","advisory"]},{"url":"https://github.com/hashicorp/consul/commit/706866fa0016b0aa302679f9c648859050d19b2e","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-gw2g-hhc9-wgjh","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-3920","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3920.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/consul","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0009.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30834","tags":["report"]},{"url":"https://docs.docker.com/engine/release-notes/#201018","tags":["web"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ/","tags":["web"]},{"url":"https://docs.docker.com/engine/release-notes/#201020","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-3920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3920","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-3920","title":"Consul Peering Imported Nodes/Services Leak","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-15T23:25:30.161Z","modified":"2025-04-29T20:02:00.547Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-7353","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-15T23:25:30Z","modified":"2025-04-29T20:02:00Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:00.012701Z"}],"ghsa":[{"id":"GHSA-gw2g-hhc9-wgjh","title":"Missing Authorization in HashiCorp Consul","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-16T12:00:20Z","modified":"2023-02-01T05:03:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2022-3920","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-16T00:15:09.747Z","modified":"2026-06-17T05:00:35.037Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"ALPINE-CVE-2022-3920","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-16T00:15:09.747Z","modified":"2026-11-03T07:30:39.900494847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-3920","title":"Consul Peering Imported Nodes/Services Leak","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-15T23:25:30.161Z","modified":"2026-10-28T02:30:21.074858343Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-gw2g-hhc9-wgjh","title":"Missing Authorization in HashiCorp Consul","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-16T12:00:20Z","modified":"2026-08-07T08:12:08.909249277Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"UBUNTU-CVE-2022-3920","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2022-11-16T00:15:00Z","modified":"2025-10-24T04:53:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"BIT-consul-2022-3920","title":"Consul Peering Imported Nodes/Services Leak","description":"HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.","status":"published","published":"2024-03-06T10:52:02.181Z","modified":"2026-09-08T08:46:00.21884115Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"GO-2022-1121","title":"Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul","description":"Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul","status":"published","published":"2024-08-21T16:03:26Z","modified":"2026-08-07T08:12:23.772786087Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"MGASA-2023-0009","title":"Updated docker packages fix security vulnerability","description":"Server side request forgery (CVE-2022-29153)\n\nBypass primary group restrictions due to a flaw in the supplementary group\naccess setup (CVE-2022-36109)\n\nImported Nodes/Services Information leak in moby-engine. (CVE-2022-3920)\n","status":"published","published":"2023-01-24T07:58:24Z","modified":"2026-04-16T04:40:41.815741113Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}