CVE-2021-36230

CVE-2021-36230 affects HashiCorp Terraform Enterprise; the issue arises from missing authorization checks on a subset of API requests executed with the run token, enabling privilege escalation to the organization owner. Affected releases are up to v202106-1, with a fix in v202107-1. The risk deta...

CVE-2023-4782

CVE-2023-4782 affects Terraform 1.0.8–1.5.6, enabling arbitrary file write during the init operation when running a maliciously crafted configuration. The root cause is within Terraform’s init phase, allowing local file writes with high impact (confidentiality, integrity, availability). The vulne...

CVE-2018-9057

The CVE-2018-9057 entry affects the HashiCorp Terraform AWS provider, specifically aws/resource_aws_iam_user_login_profile.go, through v1.12.0. The underlying issue is an inappropriate PRNG algorithm and seeding, which can let remote attackers gain access by exploiting an IAM account with a weak ...

CVE-2019-19316

CVE-2019-19316 affects Terraform (pre-0.12.17) when using the Azure backend with a Shared Access Signature (SAS). The vulnerability stems from transmitting the SAS token and state snapshot in cleartext HTTP, enabling potential interception of credentials and state data over the network. The pract...

CVE-2025-13432

CVE-2025-13432 affects Terraform Enterprise: state versions can be created by a user with insufficient permissions in a workspace, potentially allowing infrastructure alterations after a plan is approved or auto-applied. Affected versions (per connected sources) include Terraform Enterprise 1.1.0...