PT-2020-14469 · Hashicorp · Hashicorp Terraform Enterprise

Published 2020-07-30 · Updated 2021-07-21 · CVE-2020-15511

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Terraform Enterprise versions up to v202006-1

Description The issue concerns a default signup page in HashiCorp Terraform Enterprise that allowed user registration even when disabled, effectively bypassing SAML enforcement.

Recommendations For versions up to v202006-1, update to v202007-1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2020-15511

Affected Products

Hashicorp Terraform Enterprise

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-15511 · Security Note
• https://hashicorp.com/blog/category/terraform · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15511 · Vendor Advisory
• https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.md · Note