CVE-2023-3299 LOW

CVE-2023-3299: Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

Vendor Hashicorp
Product Nomad Enterprise
Weakness CWE-201
Published July 19, 2023
Last update October 17, 2024
View on NVD All CVEs

CVSS base score

3.4/10
Attack vector Adjacent
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

Key dates

02Disclosure timeline

July 19, 2023 CVE published
October 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-56300 WordPress Post/Page Copying Tool plugin <= 2.0.0 - Sensitive Data Exposure vulnerability CVE-2025-58649 WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure Vulnerability CVE-2025-49300 WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability CVE-2025-63071 WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.15 - Sensitive Data Exposure vulnerability CVE-2025-55710 WordPress TaxoPress Plugin <= 3.37.2 - Sensitive Data Exposure Vulnerability