PT-2022-17252 · Hashicorp · Hashicorp Terraform Enterprise

Published 2022-02-25 · Updated 2022-08-11 · CVE-2022-25374

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Terraform Enterprise versions v202112-1 through v202201-2

Description The issue concerns the logging of inbound HTTP requests in a manner that may capture sensitive data. This could potentially lead to the exposure of sensitive information. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For HashiCorp Terraform Enterprise versions v202112-1 through v202201-2, update to version v202202-1 or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of sensitive data exposure until a patch is applied.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-25374

Affected Products

Hashicorp Terraform Enterprise

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-25374 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2022-06-terraform-enterprise-may-capture-sensitive-data-in-logs · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25374 · Vendor Advisory
• https://discuss.hashicorp.com · Note
• https://t.me/cibsecurity/38087 · Telegram Post
• https://t.me/cvenotify/27374 · Telegram Post