CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3114 – Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool
https://notcve.org/view.php?id=CVE-2023-3114
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1. • https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329 • CWE-266: Incorrect Privilege Assignment CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25374
https://notcve.org/view.php?id=CVE-2022-25374
HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1. HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1 y v202201-2 estaban configurados para registrar las peticiones HTTP entrantes de forma que podían capturar datos sensibles. Corregido en v202202-1 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-06-terraform-enterprise-may-capture-sensitive-data-in-logs • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40862
https://notcve.org/view.php?id=CVE-2021-40862
HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be used for privilege escalation or unauthorized modification of a Terraform configuration. Fixed in v202109-1. HashiCorp Terraform Enterprise versiones hasta v202108-1, contenía un endpoint de la API que divulgaba erróneamente una URL confidencial a las partes autenticadas, que podía usarse para una escalada de privilegios o una modificación no autorizada de una configuración de Terraform. Corregido en v202109-1 • https://discuss.hashicorp.com/t/hcsec-2021-25-terraform-enterprise-configuration-versions-api-discloses-sensitive-url/29508 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3153
https://notcve.org/view.php?id=CVE-2021-3153
HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1. HashiCorp Terraform Enterpriha sidosta v202102-2 no logró aplicar una configuración a nivel de organización que requerían usuarios dentro de una organización para tener habilitada la autenticación de dos factores. Corregido en la versión v202103-1. • https://discuss.hashicorp.com/t/hcsec-2021-06-terraform-enterprise-organization-level-mfa-requirement-was-not-enforced/22401 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15511
https://notcve.org/view.php?id=CVE-2020-15511
HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. Fixed in v202007-1. HashiCorp Terraform Enterprise versiones hasta v202006-1, contenía una página de registro predeterminada que permitía el registro del usuario incluso cuando estaba deshabilitada, omitiendo la aplicación de SAML. Corregido en la versión v202007-1 • https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.md https://www.hashicorp.com/blog/category/terraform •