CVE-2023-3072CWE-266

Nomad ACL Policies without Label are Applied to Unexpected Resources

Medium · published July 19, 2023

CVSS v3.1
4.1
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2023-07-19T23:34Z
EPSS history
Timeline
  • 19 JUL 23:34Z
    Nomad ACL Policies without Label are Applied to Unexpected Resources
    cvelistv5