GHSA-f8r8-h93m-mj77

ghsaUSosv

HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation

view advisory published 2023-04-05Licence: CC-BY-4.0

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1782US	critical9.8OT elevated	0.77% (55th)	—	2023-04-05
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375WEB
https://github.com/hashicorp/nomadPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-1782ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan