Lucene search

GitHub Advisory DatabaseGHSA-V5FM-HR72-27HX

HistoryJul 20, 2023 - 12:30 a.m.

Nomad Search API Leaks Information About CSI Plugins

2023-07-2000:30:25

CWE-266

CWE-862

GitHub Advisory Database

github.com

nomad

vulnerability

csi plugins

unauthenticated users

policy

cve-2023-3300

fix

software

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

25.3%

JSON

A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.

Affected configurations

Vulners

Node

hashicorpnomadRange1.5.0–1.5.7

hashicorpnomadRange0.11.0–1.4.11

VendorProductVersionCPE
hashicorpnomad*cpe:2.3:a:hashicorp:nomad:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hashicorp	nomad	*	cpe:2.3:a:hashicorp:nomad::::::::

References

discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272

github.com/advisories/GHSA-v5fm-hr72-27hx

github.com/hashicorp/nomad/commit/a8789d3872bbf1b1f420f28b0f7ad8532a41d5e3

nvd.nist.gov/vuln/detail/CVE-2023-3300

pkg.go.dev/vuln/GO-2024-2671

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

25.3%

JSON

Related for GHSA-V5FM-HR72-27HX