CVE-2022-3866: falha de média gravidade em HashiCorp Nomad
Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5epss 0.6%
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVEs relacionadas — HashiCorp Nomad
No mesmo produto, das mais perigosas para as menos.
CVE-2026-7474HIGHNomad vulnerable to path traversal in dynamic host volume which may lead to code executionEPSS 8.2%CVE-2023-0821MEDIUMNomad Client Vulnerable to Decompression Bombs in Artifact BlockEPSS 0.8%CVE-2023-1782CRITICALNomad Unauthenticated Client Agent HTTP Request Privilege EscalationEPSS 0.8%CVE-2024-1329HIGHNomad Vulnerable to Arbitrary Write Through Symlink AttackEPSS 0.6%CVE-2023-3299LOWNomad Caller ACL Token's Secret ID is Exposed to SentinelEPSS 0.6%CVE-2023-3300MEDIUMNomad Search API Leaks Information About CSI PluginsEPSS 0.6%