PT-2023-6893 · Hashicorp+1 · Terraform+1
Lum14N
·
Publicado
2023-09-08
·
Atualizado
2025-10-20
·
CVE-2023-4782
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Terraform versions 1.0.8 through 1.5.6
Description
The issue is related to arbitrary file write during the
init operation when run on maliciously crafted Terraform configuration. This is due to incorrect restriction of the directory path name with limited access. The exploitation of this issue may allow an attacker to upload arbitrary files.Recommendations
For Terraform versions 1.0.8 through 1.5.6, update to Terraform 1.5.7 to resolve the issue. As a temporary workaround, consider restricting the use of the
init operation on untrusted configurations until the update is applied.Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Os
Terraform