CVE-2022-3866

2022-11-1006:15:09

CWE-668

HashiCorp

web.nvd.nist.gov

cve-2022-3866

hashicorp nomad

nomad enterprise

nvd

security vulnerability

metadata access

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

Affected configurations

Nvd

Node

hashicorpnomadMatch1.4.0

hashicorpnomadMatch1.4.0enterprise

hashicorpnomadMatch1.4.1

hashicorpnomadMatch1.4.1enterprise

VendorProductVersionCPE
hashicorpnomad1.4.0cpe:2.3:a:hashicorp:nomad:1.4.0:*:*:*:*:*:*:*
hashicorpnomad1.4.0cpe:2.3:a:hashicorp:nomad:1.4.0:*:*:*:enterprise:*:*:*
hashicorpnomad1.4.1cpe:2.3:a:hashicorp:nomad:1.4.1:*:*:*:*:*:*:*
hashicorpnomad1.4.1cpe:2.3:a:hashicorp:nomad:1.4.1:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
hashicorp	nomad	1.4.0	cpe:2.3:a:hashicorp:nomad:1.4.0:::::::*
hashicorp	nomad	1.4.0	cpe:2.3:a:hashicorp:nomad:1.4.0::::enterprise:::
hashicorp	nomad	1.4.1	cpe:2.3:a:hashicorp:nomad:1.4.1:::::::*
hashicorp	nomad	1.4.1	cpe:2.3:a:hashicorp:nomad:1.4.1::::enterprise:::

CNA Affected

[
  {
    "vendor": "HashiCorp",
    "product": "Nomad",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "repo": "https://github.com/hashicorp/nomad",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0"
      },
      {
        "status": "affected",
        "version": "1.4.1"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "HashiCorp",
    "product": "Nomad Enterprise",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0"
      },
      {
        "status": "affected",
        "version": "1.4.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]