CVE-2024-1329CWE-59

Nomad Vulnerable to Arbitrary Write Through Symlink Attack

High · published February 8, 2024

CVSS v3.1
7.7
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00617 · 48.9th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2024-02-08T19:20Z
EPSS history
Timeline
  • 08 FEB 19:20Z
    Nomad Vulnerable to Arbitrary Write Through Symlink Attack
    cvelistv5