Lucene search

HashiCorpCVE-2023-3300

HistoryJul 20, 2023 - 12:15 a.m.

CVE-2023-3300

2023-07-2000:15:10

CWE-266

CWE-862

HashiCorp

web.nvd.nist.gov

2465

cve-2023-3300

hashicorp

nomad

nomad enterprise

http search api

csi plugins

unauthorized access

security vulnerability

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

25.3%

JSON

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.

Affected configurations

Nvd

Node

hashicorpnomadRange0.11.0–1.4.1-

hashicorpnomadRange0.11.0–1.4.1enterprise

hashicorpnomadRange1.5.0–1.5.6-

hashicorpnomadRange1.5.0–1.5.6enterprise

VendorProductVersionCPE
hashicorpnomad*cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*
hashicorpnomad*cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
hashicorp	nomad	*	cpe:2.3:a:hashicorp:nomad:::::-:::*
hashicorp	nomad	*	cpe:2.3:a:hashicorp:nomad:::::enterprise:::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Nomad",
    "repo": "https://github.com/hashicorp/nomad",
    "vendor": "HashiCorp",
    "versions": [
      {
        "lessThanOrEqual": "1.4.1",
        "status": "affected",
        "version": "0.11.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "1.5.6",
        "status": "affected",
        "version": "0.11.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Nomad Enterprise",
    "repo": "https://github.com/hashicorp/nomad",
    "vendor": "HashiCorp",
    "versions": [
      {
        "lessThanOrEqual": "1.4.1",
        "status": "affected",
        "version": "0.11.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "1.5.6",
        "status": "affected",
        "version": "0.11.0",
        "versionType": "semver"
      }
    ]
  }
]