Lucene search

[email protected]CVE-2023-3299

HistoryJul 20, 2023 - 12:15 a.m.

CVE-2023-3299

2023-07-2000:15:10

CWE-668

[email protected]

web.nvd.nist.gov

cve-2023-3299

hashicorp nomad enterprise

acl policies

security vulnerability

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

3.9 Low

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

13.8%

JSON

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

CPENameOperatorVersion
hashicorp:nomadhashicorp nomadle1.4.10
hashicorp:nomadhashicorp nomadeq1.4.4
hashicorp:nomadhashicorp nomadeq1.4.0
hashicorp:nomadhashicorp nomadeq1.3.0
hashicorp:nomadhashicorp nomadeq1.2.15
hashicorp:nomadhashicorp nomadeq1.3.9
hashicorp:nomadhashicorp nomadeq1.4.6
hashicorp:nomadhashicorp nomadeq1.4.1
hashicorp:nomadhashicorp nomadeq1.4.2
hashicorp:nomadhashicorp nomadle1.5.6

CPE	Name	Operator	Version
hashicorp:nomad	hashicorp nomad	le	1.4.10
hashicorp:nomad	hashicorp nomad	eq	1.4.4
hashicorp:nomad	hashicorp nomad	eq	1.4.0
hashicorp:nomad	hashicorp nomad	eq	1.3.0
hashicorp:nomad	hashicorp nomad	eq	1.2.15
hashicorp:nomad	hashicorp nomad	eq	1.3.9
hashicorp:nomad	hashicorp nomad	eq	1.4.6
hashicorp:nomad	hashicorp nomad	eq	1.4.1
hashicorp:nomad	hashicorp nomad	eq	1.4.2
hashicorp:nomad	hashicorp nomad	le	1.5.6

Rows per page:

1-10 of 111

References

discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

3.9 Low

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

13.8%

JSON

Related for CVE-2023-3299

osv3 veracode1 ubuntucve1 github1 prion1 cvelist1 debiancve1