CVE-2024-1329 Vulnerability Details

  /     /     /  

CVE-2024-1329 Metadata Quick Info

CVE Published: 08/02/2024 | CVE Updated: 26/09/2024 | CVE Year: 2024
Source: HashiCorp | Vendor: HashiCorp | Product: Nomad
Status : PUBLISHED

---

CVE-2024-1329 Description

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14.

Metrics

CVSS Version: 3.1 | Base Score: 7.7 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-59
CWE Name: CWE-59: Improper Link Resolution Before File Access (Link Following)
Source: HashiCorp

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-132
CAPEC Description: CAPEC-132: Symlink Attack


Source: NVD (National Vulnerability Database).