CVE-2021-43415
Last modified
CVE-2021-43415 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.. EPSS estimates a 1.18% chance of exploitation in the next 30 days.
Description
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Nomad | >= 1.0.0, < 1.0.14 |
| Hashicorp | Nomad | >= 1.1.0, < 1.1.8 |
| Hashicorp | Nomad | 1.2.0 |
References
- https://www.hashicorp.com/blog/category/nomadProduct, Vendor Advisory
- https://www.hashicorp.com/blog/category/nomadProduct, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-43415?
How severe is CVE-2021-43415?
How do I fix CVE-2021-43415?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-4341The uListing plugin for WordPress is vulnerable to authoriza…9.8
- CVE-2021-43410Apache Airavata Django Portal allows CRLF log injection beca…5.3
- CVE-2021-43411An issue was discovered in GNU Hurd before 0.9 20210404-9. W…7.5
- CVE-2021-43412An issue was discovered in GNU Hurd before 0.9 20210404-9. l…7.8
- CVE-2021-43413An issue was discovered in GNU Hurd before 0.9 20210404-9. A…8.8
- CVE-2021-43414An issue was discovered in GNU Hurd before 0.9 20210404-9. T…7
- CVE-2021-43419An Information Disclosure vulnerability exists in Opay Mobil…7.5
- CVE-2021-4342Rejected reason: CVE split into individual CVE IDs for each …
- CVE-2021-43420SQL injection vulnerability in Login.php in Sourcecodester O…9.8
- CVE-2021-43421A File Upload vulnerability exists in Studio-42 elFinder 2.0…9.8
- CVE-2021-43429A Denial of Service vulnerability exists in CORTX-S3 Server …7.5
- CVE-2021-4343The Unauthenticated Account Creation plugin for WordPress is…9.8
Are you affected by CVE-2021-43415?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST