CVE-2022-24683

moderate-risk
Published 2022-02-17

HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root.

Do I need to act?

-
0.47% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Hashicorp

References (6)

Vendor Advisory https://discuss.hashicorp.com
Vendor Advisory https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-contain...
Third Party Advisory https://security.netapp.com/advisory/ntap-20220318-0008/
Vendor Advisory https://discuss.hashicorp.com
Vendor Advisory https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-contain...
Third Party Advisory https://security.netapp.com/advisory/ntap-20220318-0008/
35
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 2/34 · Minimal
Exposure 7/34 · Low