« Volver al listado

CVE-2020-28348

Estado: ModificadaMedia (6.5)—

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hashicorp — Nomad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-28348",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-24T03:15:13.183",
  "references": [
    {
      "url": "https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0128-november-10-2020",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hashicorp/nomad/issues/9303",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0128-november-10-2020",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/hashicorp/nomad/issues/9303",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8."
    },
    {
      "lang": "es",
      "value": "HashiCorp Nomad y Nomad Enterprise versiones 0.9.0 hasta 0.12.7, La funcionalidad sandbox del archivo Docker del cliente puede subvertirse cuando no se deshabilita explícitamente o cuando se usa un tipo de montaje de volumen. Corregido en versiones 0.12.8, 0.11.7 y 0.10.8"
    }
  ],
  "lastModified": "2026-06-17T03:10:19.220",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40E33EBF-EC1A-4233-A77B-1CCFED51C759",
              "versionEndExcluding": "0.10.8",
              "versionStartIncluding": "0.9.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94872A21-235F-448D-A87F-B7F2E93F89ED",
              "versionEndExcluding": "0.11.7",
              "versionStartIncluding": "0.11.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50CE4EDF-C375-4BEA-A67F-D703B091AA49",
              "versionEndExcluding": "0.12.8",
              "versionStartIncluding": "0.12.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDDE2BDA-B8DB-4D09-85A2-8DF93865FB11",
              "versionEndExcluding": "0.10.8",
              "versionStartIncluding": "0.9.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6E528EA-DAF2-43EC-87CF-64C02CCD1EC9",
              "versionEndExcluding": "0.11.7",
              "versionStartIncluding": "0.11.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD61694E-AF7A-4028-82F8-9C2C9BB5E8EE",
              "versionEndExcluding": "0.12.8",
              "versionStartIncluding": "0.12.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}