Lucene search

PRIOn knowledge basePRION:CVE-2023-3300

HistoryJul 20, 2023 - 12:15 a.m.

Denial of service

2023-07-2000:15:00

PRIOn knowledge base

www.prio-n.com

denial of service

hashicorp nomad

nomad enterprise 0.11.0

1.5.6

1.4.1

http search api

unauthenticated users

csi plugins

fixed in 1.6.0

1.5.7

1.4.1

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.

CPENameOperatorVersion
nomadge1.5.0
nomadle1.5.6
nomadge1.5.0
nomadle1.5.6
nomadge0.11.0
nomadle1.4.1
nomadge0.11.0
nomadle1.4.1

Name	Operator	Version
nomad	ge	1.5.0
nomad	le	1.5.6
nomad	ge	1.5.0
nomad	le	1.5.6
nomad	ge	0.11.0
nomad	le	1.4.1
nomad	ge	0.11.0
nomad	le	1.4.1

References

discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272