CVE-2023-3114mediumCWE-266

CVE-2023-3114: falha de média gravidade em HashiCorp Terraform Enterprise

Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Terraform Enterprise

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5epss 0.4%
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
HashiCorp · Terraform Enterprise
CVEs relacionadas — HashiCorp Terraform Enterprise

No mesmo produto, das mais perigosas para as menos.

CVE-2026-14468HIGHPath traversal allows arbitrary file read in Terraform Enterprise containerEPSS 0.4%CVE-2025-13432MEDIUMTerraform Enterprise state versions can be created by users with specific permissions without sufficient write accessEPSS 0.2%