Vulnerability Description
HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.
CVSS Score
9.9
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Nomad | >= 1.5.0, <= 1.5.2 |
Related Weaknesses (CWE)
References
- https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agentVendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agentVendor Advisory
FAQ
What is CVE-2023-1782?
CVE-2023-1782 is a vulnerability with a CVSS score of 9.9 (CRITICAL). HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version...
How severe is CVE-2023-1782?
CVE-2023-1782 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-1782?
Check the references section above for vendor advisories and patch information. Affected products include: Hashicorp Nomad.