CVE-2024-6717CWE-610

Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking

High · published July 23, 2024

CVSS v3.1
7.7
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00391 · 32.1th percentile
Weakness
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere
Published
2024-07-23T00:16Z
EPSS history
Timeline
  • 23 JUL 00:16Z
    Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking
    cvelistv5