CVE-2023-3300 json
Nomad Search API Leaks Information About CSI Plugins
published 2023-07-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-v5fm-hr72-27hx , GO-2024-2671 , EUVD-2023-2145
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/hashicorp/nomad | >=0.11.0, <1.4.11 >=1.5.0, <1.5.7 |
1.4.11 1.5.7 |
Affected products
- HashiCorp Nomad
- HashiCorp Nomad Enterprise
Classification
References
-
github.com
/hashicorp/nomad/commit/a8789d3872bbf1b1f420f28b0f7ad8532a41d5e3
web, patch
-
discuss.hashicorp.com
/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-3300
advisory
-
github.com
/hashicorp/nomad
package
-
pkg.go.dev
/vuln/GO-2024-2671
web
Sources
- CVE List CVE-2023-3300
- GitHub Advisory GHSA-v5fm-hr72-27hx
- NVD CVE-2023-3300
- OSV GO-2024-2671
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.