CVE-2023-3300
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
HashiCorp Nomad and Nomad Enterprise versions 0.11.0 up to 1.5.6 and 1.4.1 have a vulnerability in the HTTP search API that can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy.
Risk Assessment
The disclosure of CSI plugin names may lead to increased attack risks as unauthorized users can gain information about available system resources.
Recommendation
It is recommended to upgrade to versions 1.6.0, 1.5.7, or 1.4.1 to secure the system against this vulnerability.
Original NVD description (English source)
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.