CVE-2023-3300
published 2023-07-20CVE-2023-3300: HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.47%
37.1th percentile
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | hashicorp_nomad | >= 0.11.0 < 1.4.11 | 1.4.11 |
| github.com | hashicorp_nomad | >= 1.5.0 < 1.5.7 | 1.5.7 |
| hashicorp | nomad | 0.11.0 – 1.4.1 | — |
| hashicorp | nomad | 1.5.0 – 1.5.6 | — |
| hashicorp | nomad_enterprise | 0.11.0 – 1.4.1 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CSI plugin names disclosure in github.com/hashicorp/nomad
osv·2024-04-04
CVE-2023-3300 CSI plugin names disclosure in github.com/hashicorp/nomad
CSI plugin names disclosure in github.com/hashicorp/nomad
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability affects Nomad since 0.11.0 and was fixed in 1.4.11 and 1.5.7.
GHSA
Nomad Search API Leaks Information About CSI Plugins
ghsa·2023-07-20·CVSS 5.3
CVE-2023-3300 [MEDIUM] CWE-266 Nomad Search API Leaks Information About CSI Plugins
Nomad Search API Leaks Information About CSI Plugins
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
OSV
CVE-2023-3300: HashiCorp Nomad and Nomad Enterprise 0
osv·2023-07-20·CVSS 5.3
CVE-2023-3300 [MEDIUM] CVE-2023-3300: HashiCorp Nomad and Nomad Enterprise 0
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
OSV
Nomad Search API Leaks Information About CSI Plugins
osv·2023-07-20·CVSS 5.3
CVE-2023-3300 [MEDIUM] Nomad Search API Leaks Information About CSI Plugins
Nomad Search API Leaks Information About CSI Plugins
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-07-20
Published