Lucene search
GoogleOSV:GHSA-7WG4-8M5P-HRFGHistoryNov 10, 2022 - 12:01 p.m.
HashiCorp Nomad vulnerable to non-sensitive metadata exposure
2022-11-1012:01:03
Google
osv.dev
4
hashicorp nomad
vulnerability
metadata
exposure
software
security
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
22.9%
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/hashicorp/nomad | lt | 1.4.2 | |
| github.com/hashicorp/nomad | ge | 1.4.0 |
Related
osv
osv
CVE-2022-3866
2022-11-10 06:15:09
github
github
HashiCorp Nomad vulnerable to non-sensitive metadata exposure
2022-11-10 12:01:03
veracode
veracode
Information Disclosure
2022-11-11 06:46:36
debiancve
debiancve
CVE-2022-3866
2022-11-10 06:15:00
nvd
nvd
CVE-2022-3866
2022-11-10 06:15:09
cve
cve
CVE-2022-3866
2022-11-10 06:15:09
ubuntucve
ubuntucve
CVE-2022-3866
2022-11-10 00:00:00
prion
prion
Denial of service
2022-11-10 06:15:00
cvelist
cvelist
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
22.9%
Related for OSV:GHSA-7WG4-8M5P-HRFG