CVE-2022-25374

CVE-2022-25374 affects HashiCorp Terraform Enterprise releases v202112-1, v202112-2, v202201-1, and v202201-2, where inbound HTTP requests could be logged in a way that may reveal sensitive data. The root cause is insecure logging of inbound requests, leading to potential information exposure in ...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 did not enforce an organization-level setting requiring MFA for users within an organization. Root cause: MFA enforcement was not applied at the org level. Impact: potential weaker access controls; remediation: upgrade to v202103-1 where the MFA requ...

CVE-2023-3114

Terraform Enterprise before v202306-1 is affected by CVE-2023-3114, due to improper authorization rules for agent pools that could allow a workspace to be targeted by unauthorized agents. This could enable a workspace to access resources from another, higher-privileged workspace within the same o...

CVE-2021-40862

CVE-2021-40862 affects HashiCorp Terraform Enterprise up to version v202108-1. An API endpoint exposed to authenticated users disclosed a sensitive URL, creating risk of privilege escalation or unauthorized modification of Terraform configurations. The vulnerability is fixed in v202109-1. Affecte...

CVE-2020-15511

CVE-2020-15511 affects HashiCorp Terraform Enterprise up to v202006-1. The vulnerability is a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. Root cause: signup flow could be used to create accounts without proper SAML gating. Impact stated in so...