CVE-2020-25864: 
Consul vulnerability analysis and mitigation

CVE-2020-25864 is a cross-site scripting (XSS) vulnerability discovered in HashiCorp Consul and Consul Enterprise's key-value (KV) raw mode. The vulnerability affects all versions up to 1.9.4 and was fixed in versions 1.9.5, 1.8.10, and 1.7.14. The issue was publicly disclosed on April 19, 2021 (HashiCorp Advisory).

The vulnerability exists in Consul's key-value store API when called with the raw parameter. The KV API's raw mode, which serves KV-indexed objects without a JSON wrapper, was found to be susceptible to cross-site scripting attacks. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability could allow an attacker to perform cross-site scripting attacks through specially crafted key-value entries when viewed in Consul KV API's raw mode. This could potentially lead to unauthorized access to sensitive information or manipulation of the service (HashiCorp Advisory).

The vulnerability requires user interaction and can be exploited remotely. It has been classified with low attack complexity, requiring no privileges for exploitation (NVD).

Users are advised to upgrade to Consul versions 1.9.5, 1.8.10, 1.7.14, or newer to address this vulnerability. The fix was implemented across multiple version branches to ensure broader coverage (HashiCorp Advisory).