CVE-2021-40862

HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be used for privilege escalation or unauthorized modification of a Terraform configuration. Fixed in v202109-1...

Terraform Enterprise Configuration Versions API Discloses Sensitive URL

Summary Terraform Enterprise versions up to v202108-1 included a sensitive URL in specific responses to the Configuration Versions API, allowing potential privilege escalation or configuration manipulation. This vulnerability, CVE-2021-40862, was fixed in Terraform Enterprise v202109-1. Backgroun...