CVE-2023-4782: Terraform Allows Arbitrary File Write During Init Operation
Published Sep 8, 2023
·Updated
Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
Affected Software
3 affected componentsFixes available
go/github.com/hashicorp/terraform>=1.0.8<1.5.7
1.5.7
Hashicorp Terraform>=1.0.8<1.5.7
Terraform>=1.0.8<1.5.7
Event History
Sep 8, 2023
CVE Published
via MITRE·05:04 PM
Data Sourced
via MITRE·05:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
06:30 PM
Frequently Asked Questions
1
What is CVE-2023-4782?
CVE-2023-4782 is a vulnerability in Terraform version 1.0.8 through 1.5.6 that allows arbitrary file write during the `init` operation.
2
How can CVE-2023-4782 be exploited?
CVE-2023-4782 can be exploited by running a maliciously crafted Terraform configuration during the `init` operation.
3
What is the severity of CVE-2023-4782?
CVE-2023-4782 has a severity value of 7.8 (High).
4
How can I fix CVE-2023-4782?
You can fix CVE-2023-4782 by updating your Terraform version to 1.5.7 or later.
5
Where can I find more information about CVE-2023-4782?
You can find more information about CVE-2023-4782 on the HashiCorp discussion forum, the NVD website, and the GitHub repository for Terraform.