CVE-2022-25374 — Log File Information Exposure in Terraform Enterprise

CWE-532 — Log File Information Exposure2 documents2 sources

Severity

7.5HIGHNVD

EPSS

0.3%

top 44.66%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Hashicorp Terraform Enterprise

Timeline

PublishedFeb 25

Latest updateFeb 26

Description

HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDhashicorp/terraform_enterprise< 202202-1

🔴Vulnerability Details

GHSA

GHSA-xjhm-2p9h-g3h8: HashiCorp Terraform Enterprise before 202202-1 inserts Sensitive Information into a Log File↗2022-02-26

▶