CVE-2023-3300CWE-266

Nomad Search API Leaks Information About CSI Plugins

Medium · published July 19, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00566 · 46.2th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2023-07-19T23:35Z
EPSS history
Timeline
  • 19 JUL 23:35Z
    Nomad Search API Leaks Information About CSI Plugins
    cvelistv5