« Volver al listado

CVE-2022-24683

Estado: ModificadaAlta (7.5)—

HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hashicorp — Nomad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-24683",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-17T17:15:09.567",
  "references": [
    {
      "url": "https://discuss.hashicorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20220318-0008/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://discuss.hashicorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20220318-0008/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root."
    },
    {
      "lang": "es",
      "value": "HashiCorp Nomad y Nomad Enterprise versiones 0.9.2 hasta 1.0.17, 1.1.11 y 1.2.5 permiten a operadores con capacidades read-fs y alloc-exec (o job-submit) leer archivos arbitrarios en el sistema de archivos del host como root"
    }
  ],
  "lastModified": "2026-06-17T04:32:17.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D318B75F-E646-4674-8C0D-4C7EE247E3C6",
              "versionEndExcluding": "1.0.18",
              "versionStartIncluding": "0.9.2"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E95580D4-1646-4699-B56D-54F11711AE27",
              "versionEndExcluding": "1.0.18",
              "versionStartIncluding": "0.9.2"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B14CB96-73AF-453A-B18E-60639352ABAB",
              "versionEndExcluding": "1.1.12",
              "versionStartIncluding": "1.1.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49D886F9-9206-43EB-A1CE-4C660EC99603",
              "versionEndExcluding": "1.1.12",
              "versionStartIncluding": "1.1.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0DD0341-5D45-4277-931C-41D06CD10489",
              "versionEndExcluding": "1.2.6",
              "versionStartIncluding": "1.2.0"
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E735FB0A-7112-40FE-BC83-6A2A93E4F6CE",
              "versionEndExcluding": "1.2.6",
              "versionStartIncluding": "1.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}