Path traversal in Terraform - CVE-2023-4782

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU98805

Path traversal in Terraform - CVE-2023-4782

Published: October 18, 2024


Vulnerability identifier: #VU98805
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-4782
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences during the "init" operation if run on maliciously crafted Terraform configuration. A local user can overwrite arbitrary files on the system and escalate privileges.


Affected software

Terraform
JD Edwards EnterpriseOne Tools

How to mitigate CVE-2023-4782

Install update from vendor's website.

Terraform - update to 1.5.7
JD Edwards EnterpriseOne Tools - update to 9.2.9.2

External References

Related Security Bulletins