CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2023-3300
Medium (5.3) in hashicorp nomad. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/nomad 1.4.11, 1.5.7.
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-862, CWE-266
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:nomad
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v5fm-hr72-27hx | Go | github.com/hashicorp/nomad | >=0.11.0 <1.4.11 | 1.4.11 |
| GHSA-v5fm-hr72-27hx | Go | github.com/hashicorp/nomad | >=1.5.0 <1.5.7 | 1.5.7 |
| GO-2024-2671 | Go | github.com/hashicorp/nomad | >=0.11.0 <1.4.11 >=1.5.0 <1.5.7 | 1.4.11, 1.5.7 |