PT-2023-17240 · Hashicorp · Nomad+1

Published 2023-04-05 · Updated 2024-08-20 · CVE-2023-1782

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.5.0 through 1.5.2

Description The issue allows unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This can lead to unauthorized access and potential privilege escalation. The problem is fixed in version 1.5.3.

Recommendations For versions 1.5.0 through 1.5.2, update to version 1.5.3 to resolve the issue. As a temporary workaround, consider enabling mTLS for clusters to minimize the risk of exploitation.

Fix

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-862

CWE-285

Related Identifiers

CVE-2023-1782

GHSA-F8R8-H93M-MJ77

GO-2023-1707

Affected Products

Nomad

Nomad Enterprise

References · 13

• https://osv.dev/vulnerability/CVE-2023-1782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1782 · Security Note
• https://osv.dev/vulnerability/GHSA-f8r8-h93m-mj77 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1707 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1782 · Security Note
• https://ubuntu.com/security/CVE-2023-1782 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1782 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://t.me/cvenotify/47659 · Telegram Post
• https://discuss.hashicorp.com/t/hcsec-2023-13-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375 · Note
• https://github.com/advisories/GHSA-f8r8-h93m-mj77 · Note
• https://t.me/cibsecurity/61523 · Telegram Post