CVE-2020-15511

Опубликовано: 30 июл. 2020

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. Fixed in v202007-1.

Ссылки

https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.md
Release Notes
Third Party Advisory
https://www.hashicorp.com/blog/category/terraform/
Vendor Advisory
https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.md
Release Notes
Third Party Advisory
https://www.hashicorp.com/blog/category/terraform/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:hashicorp:terraform_enterprise:*:*:*:*:*:*:*:*

Версия до 202007-1 (исключая)

EPSS

Процентиль: 47%

0.00241

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-h44q-56vc-mpp6

github

больше 3 лет назад