CVE-2023-3299: hashicorp nomad
CVSS: 3.4v3.1LowModified
AliasesUBUNTU-CVE-2023-3299GHSA-9jfx-84v9-2rr2GO-2024-2669
Published 19-07-2023Last modified 17-10-2024
Vulnerability summary
CVE-2023-3299 is a low (CVSS 3.4) vulnerability in hashicorp nomad. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.9% of scored vulnerabilities.
CVSS score
3.4/10
010
Low · v3.1 (CVE.org)EPSS score
0.60%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 19-07-2023PublishedVulnerability first disclosed.
- 17-10-2024Last modifiedVulnerability information updated.
Description
HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
CVSS metrics
4 scores · 4 sources · 1 versionLow 3.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:NSources4 sources · 2.7–3.4
- OSV · UbuntuEcosystem advisory · calculated2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · GoEcosystem advisory · calculated3.4LowCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 21-09-2026
21-09-202621-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Hashicorp2 products
- nomad≥ 1.2.11, ≤ 1.4.10 | ≥ 1.5.0, ≤ 1.5.6
- nomad enterprise≥ 1.2.11, ≤ 1.4.10 | ≥ 1.2.11, ≤ 1.5.6
Github.com/hashicorp1 product
- nomad≥ 1.2.11, < 1.4.11 | ≥ 1.5.0, < 1.5.7
Ubuntu1 product
- nomadAll versions (No fix recorded)
3 vendors · 4 products
References
7 links
- github.com/hashicorp/nomadPACKAGE