CVE-2021-36230: hashicorp terraform Incorrect Authorization
CVSS: 8.8v3.1HighModified
AliasesCGA-c99w-554c-6p4wCGA-fqcm-8v32-ghxgCGA-h7jm-cqwv-q2vxCGA-qg6v-q73f-2pf8CGA-rx2c-f4q5-g2wfCGA-v6jx-2fhj-3944CGA-xvpq-fq4g-fcfrCGA-xwx2-mrg8-mp46CGA-4hjj-6xpx-6vf2CGA-5hjr-gq5q-pgh8CGA-63vh-qrhp-2gfvCGA-7wv7-p72q-f323CGA-98mg-xgj5-7c9pCGA-grjq-26x8-w7pvCGA-hjhx-4cxc-85v8CGA-hrr8-m2jw-qfcfCGA-jq28-4g28-m392CGA-m77f-cvjw-5m4vCGA-mjxj-67r3-q3q6CGA-mwrf-pcgr-hpfgCGA-q592-5m6w-522qCGA-qm66-qfg8-6qcrCGA-v6xq-v859-wj8hCGA-vf57-cgcp-2f4rCGA-wgcg-g669-6cqqCGA-xg66-8qwr-x2x5
Published 20-07-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-36230 is a high (CVSS 8.8) Incorrect Authorization vulnerability in hashicorp terraform. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.7% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.95%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 20-07-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.95%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
0.00 pp
From 0.95% on 20-09-2026
20-09-202620-10-2026
EPSS score0.95%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard13 products
- terraform< 1.5.7-r25
- terraform-1.10All versions (No fix recorded)
- terraform-1.10-compatAll versions (No fix recorded)
- terraform-1.10-local-provider-configAll versions (No fix recorded)
- terraform-1.11< 1.11.2-r1
Wolfi4 products
- terraform< 1.5.7-r25
- terraform-local-provider-config< 1.5.7-r25
- terragrunt< 0.76.1-r0
- terragrunt-docs< 0.76.1-r0
Hashicorp1 product
- terraform< 202107-1
3 vendors · 18 products
