Lucene search

HashiCorpCVE-2023-3114

HistoryJun 22, 2023 - 10:15 p.m.

CVE-2023-3114

2023-06-2222:15:09

CWE-266

CWE-863

HashiCorp

web.nvd.nist.gov

cve-2023-3114

terraform enterprise

authorization flaw

agent pools

unauthorized access

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

26.0%

JSON

Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.

Affected configurations

Nvd

Node

hashicorpterraform_enterpriseRange202207-1–202306-1

VendorProductVersionCPE
hashicorpterraform_enterprise*cpe:2.3:a:hashicorp:terraform_enterprise:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hashicorp	terraform_enterprise	*	cpe:2.3:a:hashicorp:terraform_enterprise::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "product": "Terraform Enterprise",
    "vendor": "HashiCorp",
    "versions": [
      {
        "lessThan": "v202306-1",
        "status": "affected",
        "version": "v202207-1",
        "versionType": "custom"
      }
    ]
  }
]

References

discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

26.0%

JSON

Related for CVE-2023-3114