GitHub Advisoryadvisory · Go

GHSA-f8r8-h93m-mj77 HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation

HIGH Published 2023-04-05 Modified 2023-04-06 Official page ↗
Aliases
CVE-2023-1782
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-285, CWE-862
Reviewed
2023-04-06

Affected packages

• Go github.com/hashicorp/nomad: >= 1.5.0, < 1.5.3 → fixed in 1.5.3

Description

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.

Related

Alias · CVE (1)

  • CVE-2023-1782 HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for… vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-862 Missing Authorization weakness

References