CVE-2023-3299 - Vulnerability Details

Vendors	Products
Hashicorp	Nomad

Link	Providers
https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description	HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.	HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
Weaknesses		CWE-201

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3299", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2023-06-16T18:47:08.212Z", "datePublished": "2023-07-19T23:35:12.990Z", "dateUpdated": "2024-10-17T14:10:40.030Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Nomad Enterprise", "vendor": "HashiCorp", "versions": [{"lessThanOrEqual": "1.4.10", "status": "affected", "version": "1.2.11", "versionType": "semver"}, {"lessThanOrEqual": "1.5.6", "status": "affected", "version": "1.2.11", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.</p><br/>"}], "value": "HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11."}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122: Privilege Abuse"}]}], "metrics": [{"cvssV3_1": {"baseScore": 3.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-09-26T20:53:39.914Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271"}], "source": {"advisory": "HCSEC-2023-21", "discovery": "INTERNAL"}, "title": "Nomad Caller ACL Token's Secret ID is Exposed to Sentinel"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:48:08.586Z"}, "title": "CVE Program Container", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-17T14:09:56.762733Z", "id": "CVE-2023-3299", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T14:10:40.030Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-3299 (string)

assignerOrgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

state : PUBLISHED (string)

assignerShortName : HashiCorp (string)

dateReserved : 2023-06-16T18:47:08.212Z (string)

datePublished : 2023-07-19T23:35:12.990Z (string)

dateUpdated : 2024-10-17T14:10:40.030Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

product : Nomad Enterprise (string)

vendor : HashiCorp (string)

versions : [ »

0 : { »

lessThanOrEqual : 1.4.10 (string)

status : affected (string)

version : 1.2.11 (string)

versionType : semver (string)

}

1 : { »

lessThanOrEqual : 1.5.6 (string)

status : affected (string)

version : 1.2.11 (string)

versionType : semver (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. (string)

}

]

value : HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-122 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-122: Privilege Abuse (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

baseScore : 3.4 (number)

baseSeverity : LOW (string)

vectorString : CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-201 (string)

description : CWE-201: Insertion of Sensitive Information Into Sent Data (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

shortName : HashiCorp (string)

dateUpdated : 2024-09-26T20:53:39.914Z (string)

}

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271 (string)

}

]

source : { »

advisory : HCSEC-2023-21 (string)

discovery : INTERNAL (string)

}

title : Nomad Caller ACL Token's Secret ID is Exposed to Sentinel (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T06:48:08.586Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-17T14:09:56.762733Z (string)

id : CVE-2023-3299 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-17T14:10:40.030Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:48:08.586Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-3299", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-17T14:09:56.762733Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T14:10:33.429Z"}}], "cna": {"title": "Nomad Caller ACL Token's Secret ID is Exposed to Sentinel", "source": {"advisory": "HCSEC-2023-21", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122: Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 3.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HashiCorp", "product": "Nomad Enterprise", "versions": [{"status": "affected", "version": "1.2.11", "versionType": "semver", "lessThanOrEqual": "1.4.10"}, {"status": "affected", "version": "1.2.11", "versionType": "semver", "lessThanOrEqual": "1.5.6"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271"}], "descriptions": [{"lang": "en", "value": "HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.", "supportingMedia": [{"type": "text/html", "value": "<p>HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-09-26T20:53:39.914Z"}}}, "cveMetadata": {"cveId": "CVE-2023-3299", "state": "PUBLISHED", "dateUpdated": "2024-10-17T14:10:40.030Z", "dateReserved": "2023-06-16T18:47:08.212Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2023-07-19T23:35:12.990Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T06:48:08.586Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-3299 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-17T14:09:56.762733Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-17T14:10:33.429Z (string)

}

]

cna : { »

title : Nomad Caller ACL Token's Secret ID is Exposed to Sentinel (string)

source : { »

advisory : HCSEC-2023-21 (string)

discovery : INTERNAL (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-122 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-122: Privilege Abuse (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 3.4 (number)

baseSeverity : LOW (string)

vectorString : CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : HashiCorp (string)

product : Nomad Enterprise (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.2.11 (string)

versionType : semver (string)

lessThanOrEqual : 1.4.10 (string)

}

1 : { »

status : affected (string)

version : 1.2.11 (string)

versionType : semver (string)

lessThanOrEqual : 1.5.6 (string)

}

]

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-201 (string)

description : CWE-201: Insertion of Sensitive Information Into Sent Data (string)

}

]

}

]

providerMetadata : { »

orgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

shortName : HashiCorp (string)

dateUpdated : 2024-09-26T20:53:39.914Z (string)

}

cveMetadata : { »

cveId : CVE-2023-3299 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-17T14:10:40.030Z (string)

dateReserved : 2023-06-16T18:47:08.212Z (string)

assignerOrgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

datePublished : 2023-07-19T23:35:12.990Z (string)

assignerShortName : HashiCorp (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*", "matchCriteriaId": "7DDC1C77-DCB0-4939-8A29-318B88383A6D", "versionEndIncluding": "1.4.10", "versionStartIncluding": "1.2.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "73FA6FFB-8FA6-4DAF-92BF-858840933D42", "versionEndIncluding": "1.4.10", "versionStartIncluding": "1.2.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*", "matchCriteriaId": "4AC3370E-CB14-4F2C-A4DB-89B181D43EAB", "versionEndIncluding": "1.5.6", "versionStartIncluding": "1.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "36217272-8A74-45D6-9511-3ED973844FF6", "versionEndIncluding": "1.5.6", "versionStartIncluding": "1.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11."}], "id": "CVE-2023-3299", "lastModified": "2024-11-21T08:16:57.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 3.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 1.4, "source": "security@hashicorp.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-20T00:15:10.447", "references": [{"source": "security@hashicorp.com", "tags": ["Vendor Advisory"], "url": "https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271"}], "sourceIdentifier": "security@hashicorp.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "security@hashicorp.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-668"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 7DDC1C77-DCB0-4939-8A29-318B88383A6D (string)

versionEndIncluding : 1.4.10 (string)

versionStartIncluding : 1.2.11 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 73FA6FFB-8FA6-4DAF-92BF-858840933D42 (string)

versionEndIncluding : 1.4.10 (string)

versionStartIncluding : 1.2.11 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 4AC3370E-CB14-4F2C-A4DB-89B181D43EAB (string)

versionEndIncluding : 1.5.6 (string)

versionStartIncluding : 1.5.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 36217272-8A74-45D6-9511-3ED973844FF6 (string)

versionEndIncluding : 1.5.6 (string)

versionStartIncluding : 1.5.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. (string)

}

]

id : CVE-2023-3299 (string)

lastModified : 2024-11-21T08:16:57.423 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : ADJACENT_NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 3.4 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.7 (number)

impactScore : 1.4 (number)

source : security@hashicorp.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 2.7 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-07-20T00:15:10.447 (string)

references : [ »

0 : { »

source : security@hashicorp.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271 (string)

}

]

sourceIdentifier : security@hashicorp.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-201 (string)

}

]

source : security@hashicorp.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-668 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object