hashicorp/nomad · Security
Nomad Search API Leaks Information About CSI Plugins
- GHSA ID
- GHSA-v5fm-hr72-27hx
- CVE ID
- CVE-2023-3300
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
CWEs
- CWE-266 · Incorrect Privilege Assignment
- CWE-862 · Missing Authorization
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3300 ↗
- https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272 ↗
- https://github.com/hashicorp/nomad/commit/a8789d3872bbf1b1f420f28b0f7ad8532a41d5e3 ↗
- https://pkg.go.dev/vuln/GO-2024-2671 ↗
- https://github.com/advisories/GHSA-v5fm-hr72-27hx ↗