CVE-2025-13432mediumCWE-863

CVE-2025-13432: falha de média gravidade em HashiCorp Terraform Enterprise

Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access

Publicada em

Seguir esta CVE+ Monitorar Terraform Enterprise

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.2%
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
HashiCorp · Terraform Enterprise
CVEs relacionadas — HashiCorp Terraform Enterprise

No mesmo produto, das mais perigosas para as menos.

CVE-2026-14468HIGHPath traversal allows arbitrary file read in Terraform Enterprise containerEPSS 0.4%CVE-2023-3114MEDIUMTerraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent PoolEPSS 0.4%