CVE-2023-3300
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
CSI plugin names disclosure in github.com/hashicorp/nomad
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | github.com/hashicorp/nomad | >=0.11.0,<1.4.11 | 1.4.11 |
| Go | github.com/hashicorp/nomad | >=1.5.0,<1.5.7 | 1.5.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3300
- https://github.com/hashicorp/nomad/commit/a8789d3872bbf1b1f420f28b0f7ad8532a41d5e3
- https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272
- https://github.com/hashicorp/nomad
- https://pkg.go.dev/vuln/GO-2024-2671
Verify integrity in audit chain (admin only). AS-IS.