CVE-2023-1782

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-1782
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1782.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-1782
Aliases
Downstream
Published
2023-04-05T19:10:52.697Z
Modified
2026-07-15T01:49:08.844378704Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation
Details

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.

Database specific 
{
    "cna_assigner": "HashiCorp",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1782.json",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/hashicorp/nomad

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/nomad
Events
Introduced
fc40c491cacec3d8ec3f2f98cd82b9068a50797c
Fixed
434f7a1745c6304d607562daa9a4a635def7153f
Database specific 
{
    "cpe": [
        "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "1.5.3"
        },
        {
            "last_affected": "1.5.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1782.json"