Medium WID-SEC-2023-1552 1 CVE

Hashicorp Terraform: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Published Jun 22, 2023 · Updated Jun 22, 2023 · de-DE

Vendor: HashiCorp Product: Terraform Enterprise < v202306-1 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Hashicorp Terraform ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

Terraform ist ein Infrastruktur-als-Code-Tool.

Vulnerabilities 1

Medium 5.0

CVE-2023-3114

Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate,…

HashiCorp Terraform Enterprise

Jun 22, 2023

Revision history

2023-06-22 #1
Initiale Fassung

References

Hashicorp Terraform Security Advisory vom 2023-06-22
https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329