5.3

CVE-2023-3300

Nomad Search API Leaks Information About CSI Plugins

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hashicorp ≫ Nomad SwEdition- Version >= 0.11.0 <= 1.4.1
Hashicorp ≫ Nomad SwEditionenterprise Version >= 0.11.0 <= 1.4.1
Hashicorp ≫ Nomad SwEdition- Version >= 1.5.0 <= 1.5.6
Hashicorp ≫ Nomad SwEditionenterprise Version >= 1.5.0 <= 1.5.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.81% 0.743
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
security@hashicorp.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.