CVE-2024-7625 Vulnerability Details

  /     /     /  

CVE-2024-7625 Metadata Quick Info

CVE Published: 14/08/2024 | CVE Updated: 25/09/2024 | CVE Year: 2024
Source: HashiCorp | Vendor: HashiCorp | Product: Nomad
Status : PUBLISHED

---

CVE-2024-7625 Description

In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.

Metrics

CVSS Version: 3.1 | Base Score: 5.8 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-610
CWE Name: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Source: HashiCorp

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-130
CAPEC Description: CAPEC-130: Excessive Allocation


Source: NVD (National Vulnerability Database).