-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/nomad | go | >= 0.11.0, < 1.4.11 | 1.4.11 |
| github.com/hashicorp/nomad | go | >= 1.5.0, < 1.5.7 | 1.5.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing ACL checks in three key areas: 1) sufficientSearchPerms lacked plugin permission validation (AllowPluginList), 2) filteredSearchContexts didn't filter plugin contexts, and 3) AllowVariableSearch had incorrect wildcard namespace handling. The commit adds plugin ACL checks in sufficientSearchPerms (case structs.Plugins) and filteredSearchContexts, and modifies AllowVariableSearch to handle wildcard namespaces properly. These missing checks allowed unauthorized users to see plugin names and variables through search endpoints.
Ongoing coverage of React2Shell