CVE-2023-3300 — Nomad Search API Leaks Information About CSI Plugins

Description (CNA)

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Nomad	affected 0.11.0 through 1.4.1; affected 0.11.0 through 1.5.6
HashiCorp / Nomad Enterprise	affected 0.11.0 through 1.4.1; affected 0.11.0 through 1.5.6

CWE

CWE-266

References

https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272

ADP enrichment

CVE

No English description supplied.

https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272

CISA-ADP

No English description supplied.

No references supplied.